Right. In the case of USDC, whoever has the private key to their proxy contract’s owner account. You’re trusting their engineering team to do the right thing.
(EDIT: if I’m reading my etherscan correctly, it’s account 0xfcb19e6a322b27c06842a71e8c725399f049ae3a with upgrade rights. Sorry, I’m in transit so tapping on my phone.)