The issuer holds no keys over $HASH. The supply cannot grow, balances cannot be frozen or removed, and none of that can be added later.

Read from the Hedera mirror node, where a token declares its keys as properties rather than hiding them in contract code. These are the powers the issuer holds, not a judgement about the token: plenty of legitimate projects keep a supply key, and a stablecoin needs a freeze key to comply with the law. What matters is knowing which ones exist before you buy.