This is true but COMP has had exploits and their CEO also begged its users to send funds back last time it happened while threatening to doxx them[0] so perhaps not the best example.

Your overall point is valid though, and it's not like it happens just in crypto - e.g. this paypal auth hack is not too disimilar and that's a much bigger company[1].

0. https://decrypt.co/82387/defi-community-blasts-compound-ceo-...

1. https://www.consumeraffairs.com/news/paypal-hackers-are-targ...