A timelock turns an instant change into a scheduled one. A 48-hour delay means a proposal to seize funds, however it passed, is publicly visible for two days before it can execute, and depositors can withdraw in the meantime.
Judge the length against how fast users could realistically act. Twelve hours across a weekend is not a real window. Anything under a day on a protocol holding significant deposits should be read as a convenience for the team rather than a protection for users.
The critical question is what it covers. A timelock on parameter changes but not on contract upgrades, or one the admin multisig can bypass in an emergency, leaves admin-key-risk intact. Check the deployed contracts rather than the documentation.
Related: admin-key-risk, governance-proposal, dao, smart-contract-audit