People look at decentralization as an ideology rather then a threat model. The security you might implement to protect $100 vs $100k vs $100 million is different. Running your blog on AWS is running your own server in a decentralized sense; but if your threat model includes Amazon shutting you down or something like the US Govt/public compelling Amazon to shut you down then it might not be good enough. Which is why Target, Walmart, Parler (assuming that's still true) don't run on AWS. Any threat model is about mitigation and acceptance of risk. Easiest way to secure a database/system is to isolate it from the internet and let nobody read/write from it; probably wouldn't be a very useful system for most usecases but something you might do for the nuclear weapons arsenal.

Centralization vs Decentralization is a similar concept to closed source vs open source. Just because the code is open source doesn't mean that people are going to download the source code and compile it themselves. The option to fork the codebase is also there. Neither of those options are possible for a closed source project. And to your point, the fact that a project is open source might not "actually have any effect at all". Doesn't mean the concept is inherently bad.