A dapp of any sufficient complexity will have bugs, some of which can probably be exercised to steal funds.