Is there any risk here given the last audit in the Aave v2 contracts was in early 2021?

This commit contains the change, it moves the Pool address from a parameter to the constructor, to prevent someone from injecting their own pool contract and transferring tokens in case someone accidentally sent them directly to this contract.