1. Regarding malicious smart contracts, they can steal only from incompetently written smart contracts.
2. Regarding refunds by large vendors, that's the ideal, but not the reality. I have had Uber reject a refund for unfair reasons when the driver was wasting time and didn't show up for over 15 minutes past the estimated time. I have also had Google provide me no refund for a large transaction on a scam app that fooled me.