The userbase is not fully centralized. It's mostly centralized, but users who care can manage their own data independently of bluesky.

While it's true that they have 'full' control over the protocol, they've stated that the goal is to hand it off to a more democratic organization once it's stable. This seems like a reasonable choice and I see no reason to distrust their motives here. Even if they did try something underhanded, it's not hard to fork the repositories and force the enshittified version to compete with the original.