A protocol is just code, code can have bugs. Another risk is around governance. Some protocols use proxy contracts, so a single developer or team can upgrade them. But they can accidentally push out a bug in a new version. Other protocols like Uniswap opt for non-upgradeable contracts, users have to opt-in to the new version.