They control the gateways which means they have the real coins and you're at their mercy just like any other exchange. The only difference is that trades between IOUs happen in an open-source platform and are published on a public ledger.