Sorry, I should've added more context.
The standard decentralized setup is this:
1. Developers write a smart contract that does something. For example, a token exchange to trade tokens, or a derivatives exchange to trade exposure to tokens/real world assets/etc.
2. Developers publish the source code for this smart contract, deploy it to the chain, and, with the leverage of basic cryptography, make it impossible to change the code --- make it immutable.
3. Anyone who now comes along to use their smart contract does not have to trust the developers because they can 1) read through the open source code and 2) verify that the open source code they are reading is the same as the code deployed on chain. Of course this does not eliminate the risk of unforeseen bugs in the smart contract, which is known as "protocol risk."
If you say you are building a decentralized exchange, that is what you're doing. Otherwise, you're arguably committing fraud.
Many companies want to build financial primitives like decentralized exchanges, hopefully because they think that's where the future will lead and ultimately because there is a lot of money to be made. However, companies must comply with the rules and regulations of the jurisdictions in which they operate. These regulators nearly always insist on the ability to intervene. This creates a slightly different setup:
1. Same as above
2. Same as above, but strikeout the "make immutable" part and leave in an "upgrade authority" backdoor, which allows the code of the smart contract to be replaced (avoiding semantics). This upgrade authority can be gated by a multi-sig, requiring m of n keypairs to sign for new code to be deployed.
3. Often the code is still published, but there are many cases where the code remains closed-source.
The original commenter said this, in paraphrase:
> If you get access to the deploy keys to a decentralized exchange, can't you just deploy new code and take all the funds?
The answer is "no" because a decentralized exchange is immutable. If it were not immutable, then it would not be a decentralized exchange.
If, however, the exchange was not actually decentralized, but fraudulently claimed to be, then yes, you can do exactly as the original commenter speculates.