Doesn't the WETH smart contract store all the tokens it receives at its address? Doesn't anyone have the private key of that address?
It's been quite a long time since I have been playing with smart contracts and I don't actually remember what happens when a smart contract is created.
Don't know the code for specific code for that contract but contract wrapping/unwrapping doesn't necessarily imply that anyone can withdraw ethers sent via normal means. If the contract is upgradeable it would be possible but being upgradeable should be built into the contract first.
It's been quite a long time since I have been playing with smart contracts and I don't actually remember what happens when a smart contract is created.