I don't quite follow #2. BAT is an ERC20 token like any other and can be quite easily transacted outisde of the browser and outside of Brave's control.
That doesn't equate to having full control over the monetary flow. They can mint new tokens, but since the contract doesn't have a self destruct function, it's out there on the blockchain forevermore, even if Brave were to disappear tomorrow.