This isn't discussed much that I've ever seen.

The devs are not normally considered a risk because people in the btc community over-index on the technical structures in the ecosystem, and under-index on the social structures. What gets merged in the code is the result of human judgment, and judgment is a social product. The opinions we all have are the result of social processes.

The mantra of DYOR ignores the fact that the R comes from someplace -- it comes from the ideas that are laying around. So which ideas are lying around? In many cases they come from idea intermediaries, since people are famously reluctant to think for themselves.

I think this means that, while exerting significant influence over core development is a kind of quasi-centralization risk, the nature of the 'risk' is worth thinking about. Specifically, it's hard to decouple 'risk' from 'influence' and as social primates, we will never be free from influence.