The issuer holds no keys over MCAT. The supply cannot grow, balances cannot be frozen or removed, and none of that can be added later.

Read from the Hedera mirror node, where a token declares its keys as properties rather than hiding them in contract code. These are the powers the issuer holds, not a judgement about the token: plenty of legitimate projects keep a supply key, and a stablecoin needs a freeze key to comply with the law. What matters is knowing which ones exist before you buy.