Even bitshares presents risks.
Yes, because you don't necessarily have the private keys on Bitshares (except for Bitshares itself). Most of the entities such as OpenLedger will hold the keys for you and it's just like holding on a centralized exchange.
Exactly...you are still beholden to .open to remain solvent and loyal