The support rep sounded defensive when he said they weren't working on an ERC-20 token, it's its own cryptocurrency. (I hadn't said Ethereum token, I just said "token code".)

Be that as it may, your observation is exactly correct: one scenario could be -- they are taking ETH in, and can abandon their poorly-coded cryptocurrency without any risk, even if it is poorly coded and their wallets even leak -- because they're not putting anything into those wallets. The ETH goes into their fast cars and nosebleeds.

Note that this is pure speculation, I know very little about this company other than having gotten a newsletter mentioning it, and remembering having seen it discussed here somewhere, or one of the coin news sites I read, and so figured I'd put the minimum in and see what happens.

Didn't think I'd get a post out of the experience! :)