The point is self custody. Even if a trade were to fail (it’s more difficult than you might think) the funds stay in you custody before and after the trade. That’s different from a cex where you’re trusting someone to hold all your assets. Someone like SBF could not do a similar fraud, even if such a party existed within bisq.

Regarding code, there have been attempts by people to take over p2p protocols before. Most famous was Justin Suns takeover of Steem. Since all the code was open source, most of the community forked the code over to Hive successfully. If a malicious actor tried something similar with Bisq, the community would just fork an older version of the code.

More fundamentally, these protocols work because people are incentivized to make them work. It’s quite different than the vc crypto with the big marketing budgets that most people hear about; most of those are just traditional finance reskinning itself.