An application described as decentralised generally has one decentralised component. Everything the user actually touches tends to run on conventional infrastructure owned by somebody in particular.
The contract is only part of the system
Smart contracts hold balances and enforce rules, and they continue running regardless of what happens to the team that deployed them.
The website that lets people interact with those contracts is a normal web application served from a normal host under a normal domain name.
If the domain expires or the host removes the site, the contract is unaffected and the users are locked out of the only interface they know.
Reading a chain is harder than writing to it
Submitting a transaction is straightforward, but displaying a user's history, positions or holdings requires querying data that chains are not organised to answer quickly.
Applications therefore rely on indexing services that ingest chain data and expose it through a conventional interface.
Those services are operated by companies, and an outage produces an application that appears empty or broken even though the underlying state is intact.
Most wallets talk to a small number of providers
Connecting to a network requires a node, and running one is beyond what most users will do, so wallets default to hosted endpoints.
A handful of providers therefore serve a large share of all traffic, and they can see which addresses are asking about what.
An endpoint can also return incomplete or stale data, and a user has no independent way to detect it without a second source.
Off-chain components handle what chains cannot
Order books, notifications, search and anything requiring low latency are impractical to run on chain, so they are built conventionally and connected at the edges.
This is often a reasonable engineering choice rather than a compromise, since not every function benefits from consensus.
The difficulty is that the resulting system is described by the properties of its most decentralised part rather than its most fragile one.
What reduces the dependency
Publishing interfaces to content-addressed storage means the front end can be served by anyone, and no single host removing it makes it unavailable.
Documented contract interfaces let alternative interfaces exist, so users are not dependent on one team's website continuing to operate.
The practical test is whether a user could still access their funds if the project's website disappeared tomorrow, and for many applications the honest answer requires technical skill most holders do not have.