An application described as decentralized usually has contracts that no one can alter. Getting to those contracts, however, generally involves several conventional companies.
The interface is an ordinary website
Users reach most protocols through a web page served from standard hosting under a registered domain name. Both the hosting and the domain are held by an identifiable entity.
That entity can take the site down, restrict access by region or modify what the interface displays. None of this touches the underlying contracts.
The gap between "the protocol still works" and "users can reach it" has been demonstrated repeatedly when front ends went offline while contracts continued operating normally.
Reading the chain requires a node
Displaying a balance or a transaction history means querying blockchain data, which requires a node. Running one is demanding enough that most applications do not.
Instead they use commercial providers offering node access as a service. A large share of applications route their requests through a small number of such firms.
An outage at one of these providers makes many unrelated applications appear broken simultaneously, even though the chains themselves are producing blocks normally.
Indexing turns raw data into something usable
Blockchain data is organized for verification rather than for queries. Asking which tokens an address holds is not a question the raw structure answers efficiently.
Indexing services process chain data into databases that respond quickly to application queries. Almost every interface with a useful display depends on one.
These services introduce their own trust assumption, since the application shows what the index reports rather than what it verified itself.
Wallets are software with vendors
Browser extensions and mobile wallets are distributed through app stores and extension marketplaces operated by large technology companies subject to their policies.
Those companies have removed crypto applications from distribution before. Users who cannot install or update a wallet are functionally excluded regardless of what the chain permits.
Software updates arrive through the same channels, which means the vendor's release process is part of the security model whether users think about it or not.
The dependencies are visible if you look
None of this makes decentralization meaningless. Contracts that cannot be changed and assets that cannot be seized are real properties with real consequences.
The accurate description is that different layers carry different guarantees. Settlement may be resilient while access is not.
Users who understand the stack know which failures they can route around. Interacting with a contract directly remains possible when everything above it stops working.