How Does a Time-Lock Protect against a Compromised Owner Key?

A time-lock protects against a compromised owner key by preventing the immediate execution of a malicious transaction, even if it is signed by the legitimate key. If an attacker gains control of the owner key and attempts to drain the treasury or deploy a malicious upgrade, the transaction must first enter the time-lock queue.

The mandatory delay (e.g. 48 hours) gives the community, other core developers, or security bots time to detect the malicious transaction and take defensive measures, such as exiting the protocol or triggering a contract pause.