Is there a smart contract risk on L2?

L2 should inherit L1 security, but is it possible for these L2s to have a crictical smart contract bug that can be exploited and allow hackers to steal user funds?