Yes, it's a risk. If a contract or protocol is several years old, processing billions per day, and the code is un-upgradeable, you might say the risk is lower.

I'd rather gamble with Uniswap protocol risk than FTX human fraud and greed risk.