Oracle updates carved out of the timelock is exactly how Mango ($117M) and Inverse Finance ($15.6M) got drained — the "fast path" for price feeds becomes the fast path for attackers. 6-of-9 only means something if you know who the 9 are and whether any have ever voted against a proposal. Emergency pause is the other escape hatch governance attackers love — plenty of protocols have coincidentally paused right before an insider exit.

Top comment by @Benthic