See _refundToken() method:
In case the _refundAddress is a contract (its not documented that it cannot be a contract), the transfer might revert (out of gas, cannot accept native token, logic error, etc.) which leads to OFTs being temporarily stuck in the contract. 
See also Attack ideas in README:
Use call(...) instead and check the success return value. If it returns false, wrap the native gas tokens into an ERC-20 (see also WETH) and transfer them to the _refundAddress.
