Actually they most certainly can and have. The ERC20 contract for USDT has a blacklist function and the administrator can block transfers for arbitrary addresses, rendering it worthless. Same with USDC.