You're right in fact they are. Just like Ripple, you have to trust that the controlling organization do not release the remaining supply in a dump.