The risk vector isn't that the dev team will push "PR 666: add master key to all wallets". It's that someone will introduce a subtle bug (such as a side channel leaking your private key), which goes undetected for months or years, until it's revealed that they've been slowly siphoning off and selling bitcoin they weren't entitled to. In a scenario like that, people might not attribute value to the current chain or the months-old clean one.