An application whose logic lives in a smart contract is still delivered to users through ordinary web infrastructure. The gap between the two is where most practical centralisation sits.
Reading a chain requires a node
Contracts cannot be queried directly from a browser. Something has to maintain a copy of the chain and answer questions about it.
Running that yourself demands hardware, bandwidth and maintenance, which almost no application asks of its users.
Instead, applications connect to a hosted node service, and a small number of providers serve a large share of all requests across the ecosystem.
The interface is a normal website
The page users interact with is served from a domain name, hosted on conventional infrastructure and delivered through a content network.
Each of those layers has an operator who can change what is served, and a domain registration that can be transferred or seized.
Attacks on this layer have been more common than attacks on contracts, because replacing a front end so that it proposes malicious transactions requires no exploit of the contract at all.
Indexers sit between contracts and displays
Chain data is stored for verification rather than for querying, so producing a portfolio view or a price chart requires processing it into a database.
Applications rely on indexing services for this, and a stale or incorrect index shows users wrong information even when the underlying contract state is correct.
The contract remains the authority, but the version of reality most users see is assembled by intermediaries they never chose.
Why the dependencies persist
Each of these services exists because it is difficult and expensive to run, and the alternative imposes cost on every user rather than on the application.
Decentralised substitutes exist for hosting, naming and indexing, and adoption is limited by latency, cost and the effort of integrating them.
The pattern is familiar: convenience concentrates infrastructure, and concentration reappears above a decentralised base layer.
What the base layer still guarantees
None of these intermediaries can move funds, because doing so requires a signature from the user's key.
What they can do is present false information, propose harmful transactions, or become unavailable, and the last of these has taken applications offline while their contracts kept running.
The practical protection is verifying transaction details in the wallet rather than in the page, since the wallet is reading the transaction itself rather than the site's description of it.