It is a matter of jurisdiction and recourse as well as expectations and reasonableness of expectations.
Example: a bank (assuming paper cash, physically deposited)
If you put money in a bank, you hope and expect that you can withdraw that money later. To be clear, the bank has agency here. There is no amount of force that can require a bank to pay you back. If your money is in the bank, and the militaries of the world all show up to demand the money, and all the weapons, and psychology and influence of the entire universe work together, it is still possible that the banker, who has locked their doors, will blow up the money before it can be taken.
Again you are relying on trust, governments and protocols to protect your interest in the money you have in the bank. You expect these things to work. And this expectation is reasonable, at least in the US with FDIC insurance.
Example: a non-upgradable smart contract
You have been granted an NFT by a non-upgradable smart contract.
Again, here you hope and expect that your NFT will not be exit-scammed or stolen. Why do you expect this? Because you read (self or delegated) the smart contract and also you trust that the Ethereum Foundation will not (again) steal assets from people in an overnight decision without community input. You expect these things to work and this is reasonable.
Example: a upgradable or backdoor smart contract
In this example you control tokens in Tether, USTD, the fund with a reported USD 60B in funds committed.
The owner of this contract has control over backdoors. Specifically, they can "blacklist" (a racist term) and take tokens from any account and then assign them to itself. The Tether project self-reports its location in "Hong Kong" but does not appear to have the required Hong Kong "Money Service Operators" license, nor any incorporation at all per the Hong Kong Companies Registry. There is no commitment on the Tether website to say they will not take your money only because you are dark-skinned (that's what a blacklist means). Furthermore, you don't know who controls the Tether account, and it is very reasonable to assume that because it started from meager beginnings (possibly low operational security) that there will be several governments and/or hackers that additionally have access to the Tether administrator private keys.
Given this contradiction with government records, lack of regulatory authority to do business, explicit racism, failure to make policies like a bank, and not further mentioning their otherwise lack of accountability, expecting your assets to still be there when you need them is unreasonable.
Tether is the best example I can find of something that looks like a big exit scam.
Summary
Every upgradable smart contract deployed/controlled other than by somebody you personally know/trust is susceptible to becoming like Tether and exit scamming.
