Yes, when you add a token manually, you’re warned that anyone can add a token and that you should exercise caution.