But the smart contracts they write look up a blacklist, which only they control. They can block, unblock or burn tokens.
To “reverse” something they could burn those tokens, and then just issue more and send the new ones to the original address.
So yeah it’s like PayPal or whatever. Except with blockchain thrown in so they can say the rules don’t apply to them.
Also notice there's no option to automatically transfer received money into your real checking account. They are banking on you forgetting your money is there and they are earning the interest but not passing it to you.
For this reason I prefer receiving money via Zelle but pay with Venmo.
The “solution” for decentralisation - proof of work - makes the system a lot more expensive (think: higher fees) than a centralised database.