The pool could get hacked if the code isn't audited. There have been cases of hackers draining funds from smart contracts. It helps if the code is audited by a reputable firm. In the case of SushiSwap, it has been given a "security review" (not an audit) by Quantstamp. 10 issues were identified but they do not appear to be fatal. Subsequently, Peckshield had completed an audit on SushiSwap. They found no critical or high severity issues relating to business logistics but 2 high severity opsec issues that need to be fixed through extra care with deployment.