Yes but even then: If they make 2+2 wrong and people notice, people can just continue to use the correct version.

I don't know the matrix org but if I were them I had a plan in a drawer for when that happens and where to move.

Any open source project can be made unsafe intentionally or unintentionally, with or without people noticing, is there anything unique to this risk with Matrix?

It's a protocol, people can use the old version (or patch whatever makes it unsafe).