You're right, there is no way to cryptographically prove that there are no contracts external to the blockchain. The audit is from a purely "not your keys, not your coins" perspective. And there's no way to prove they won't go get some USD loans tomorrow either, since you can't cryptographically prove the future.
Your defense against these tail risks is to remember, "not your keys, not your coins", and self-custody when you're not actively exchanging. In the end you do have to hope that the < 1 hour it takes you to exchange your coins and transfer them back to your own wallet doesn't overlap with the moment they decide to torpedo their 10+ year old business with no prior warning or red flags. But these are infinitesimally small tail risks.