It wouldn't be too hard to make a smart contract only be able to transfer X amount out per time period and then still allow individual users to emergency exit.

It wouldn't be too hard to make a smart contract only be able to transfer X amount out per time period and then still allow individual users to emergency exit. Then you can concentrate auditing logic on the emergency exit code as opposed to the entire surface area.