Cryptobros try to pretend because "web3" is blockchain, that the blockchains will reveal anything bad before it can happen.

Completely untrue, of course. There's always a real-world link(because otherwise nobody would be profiting(people want stuff)/nothing would actually happen)

Aave cannot fake its risk parameters because it's fully on chain and anyone can check them.

Crypto scams are always off chain (like FTX and many more) or have smart contracts that can be upgraded by anyone (but again, anyone can check that the contracts can be upgrade and by whom).