I think there's one other aspect here that needs to be considered, which is what happens when undocumented features appear, as with the Polkadot fiasco, among others, where bugs in the shared walletsplus some thirs party actions used by many led to $hundreds of millions being completely inaccessible to all (ineptness, or malice, it is not clear).

The contracts were verifiable and correct enough, it seems, but some of the infrastructure turned out to be faulty, leading to a platform that was not trustworthy.