Permanent fund loss and the protocol being stuck in an unrecoverable state.
If the treasury address gets compromised (e.g., private key stolen or malicious insider), the attacker gains full control over the treasury operations and steal the protocol fee indefinitely. 
If an attacker controls the treasury, they can block updates by refusing to change the address or setting it to a malicious address that locks further changes.
The protocols ability to recover control is lost since only the compromised treasury has the power to update itself.
https://github.com/code-423n4/2024-10-ramses-exchange/blob/4a40eba36bc47eba8179d4f6203a4b84561a4415/contracts/CL/gauge/FeeCollector.sol#L49-L54
Implement only the admins (onlyOwner) can change new treasury address instead of old treasury itself.
