Even Certik brought up the same issues as Rugdoc. This was the recommendation by Certik when it comes to the migrator function: We recommend to either removing such functionality on migrate; or having a timelock as the controlling party with enough delay for such privileged function invocations. The project shall also make clear statement or documents on how they plan to leverage the migrate functionality for proper usage.

Biswap did add a timelock but I'm not sure 6 hours is enough of a delay. There is also no clear statement on how they intend to use this functionality. The likelihood of a hard rug at this stage seems very low in my opinion but since the possibility is still there then it is fair to classify them as high risk according to Rugdoc's standards.