When you interact with a certain contract, you are likely interacting with the ProxyContract which relays your calls to the actual contract. The proxycontract is often under lock or has multiple signatories to amending but the "origin" contract doesn't.

So many DeFi projects get "audited by Certik" actually just get their proxy contracts audited and there is nothing in there but a single line per function, calling the origin contract.