So a “defi” Eth protocol is updated to steal back previously stolen eth.

How do they get away with calling something decentralized when one entity controls the funds?

It decentralization theater all the way down.