Are audited projects necessarily safe?
If code is modified after an audit, or the version actually deployed differs from the audited version, the audit findings may not apply. Many protocols run bug bounty programs to reward white-hat researchers who report vulnerabilities.
Contracts that have been running for a long time and have stood the test of handling large amounts of funds are generally considered more reliable, but that still doesn’t mean they have no vulnerabilities.
Ethereum, where $ETH is located, is one of the earliest public blockchains to support general-purpose smart contracts.