In unlocked pools the market maker could add a “fake oracle” and use it to drain the funds
The system has been designed to allow any new oracles to be added and options sold for it. Unfortunately there is no way of knowing if the next new oracle being added can be trusted. A market maker could create a fake oracle and use it to drain the funds in the pool.
To mitigate this risk market maker can make a pool read-only, stopping the ability to enable/disable oracles( or change any other configuration ).
You should either trust market maker or only deposit funds to pools that have been set to read-only.