Question on L2 security

I'm trying to understand the security and risks behind L2s. On l2beat.com, the thing that sounds most scary to me is the upgradeability. For most L2s, including Arbitrum, it says "Funds can be stolen if a contract receives a malicious code upgrade. There is no delay on code upgrades (CRITICAL)."

Am I understanding this correctly that they could just deploy an upgrade to their contract that allows them to immediately steal all the funds?

I really hope I'm misinterpreting or missing something there, as this would obviously be a huge red flag.