Who can change this contract?

Paste a contract address on Arc mainnet. The page reads the chain from your browser and tells you whether the code behind that address can be replaced, and who holds that power: one key, a multisig, or a timelock. Then you can pin what you saw onchain, so if it ever changes, the difference is visible to everyone.