Unprotected initialize() in Timelock — governance takeover risk

[angguntrie3-lgtm]

hey, noticed that the Timelock initialize() function has no access control beyond OpenZeppelin initializer modifier:

function initialize() external initializer {
    instaIndex.updateMaster();
    instaIndex.changeMaster(governanceTimelock);
}

If the timelock is deployed but not yet initialized, anyone can call initialize() which:

1. Sets the timelock as master via instaIndex.updateMaster()
2. Transfers master to governance timelock via instaIndex.changeMaster()

This could hijack master governance of the entire InstaIndex if deployment and initialization are separated in time.

Is this a known risk? Or should initialize() be restricted to a specific deployer?