“TLDR: they can pull $$ even if the owner is the null address,” writes Zachxbt.