That's right. There is always a way to scam people. But in this case it will come down to the smart contract that was used and the platform it was built on top of. Smart contract platforms also have exploits that can lead to funds being stolen.
There is also a problem with the organizer refusing to pay. Since the lottery methods that I've seen rely on the hash of the seed being released (the seed itself is needed to determine the winner) the organizer can refuse to publish the seed for the winner to take his reward.