Bitcoin has rules without rulers.
Bitcoin has many groups of people who independently write software that implements those rules.
There are many different groups of people who independently create Bitcoin software. For example there are many different wallet programs/apps.
The developers of any piece of software usually don't have the ability to force users of that software to upgrade. However such users are reliant on the honesty of the developers if they can't download and inspect the source code themselves. Many people rely on open-source software because it does mean ordinary users can inspect the code and verify that the software can be compiled from that code. Most users probably do assume that someone else will have done this and will let the world know of any malicious code.
When you choose to use a website or choose to install a Bitcoin program or app it is important that you are vigilant and diligently check the credibility of the source and the authenticity of the websites or programs.
There is no single person or organisation with the power to make changes to the Bitcoin network.
There is an open process for proposing changes to the Bitcoin rules but no-one has the power to force other people to adopt those proposed changes.
if there was a major bug discovered in the Bitcoin architecture, there is someone who would have the power to push an update and fix it.
There are a group of people who could propose a fix. They cannot force anyone to implement the fix and cannot force people to upgrade to the fixed version.
I assume that they could also make changes for malicious purposes.
Proposals for rule changes that are malicious would quickly be seen because the whole proposal process is public. There are many different participants with a huge financial incentive to see that the rules are not malicious.
The developers of a closed-source wallet program or custodial-wallet service could make malicious changes. They could only affect their own software and not directly affect people using other software. This is one reason why those categories of software (closed-source and custodial) are regarded as the least trustworthy.
The nearest cases to this that I know of are
- Multiple failures of custodial services (exchanges etc) where theft or fraud has occurred. MtGox, Quadriga-CX etc.
- Fake wallets such as the Electrum hack a few years ago.
Who has the power to make changes to the Bitcoin architecture
You or I could propose a change. We would have to provide a well-reasoned case supported by evidence in order to convince many other independent groups of people in many countries to support and adopt that change.
Could they turn of the Bitcoin system completely?
Even if you could somehow infiltrate and make several software products stop
working, people with other software would be unaffected and affected people would switch to unaffected software. Any damage made by malicious software to the "blockchain" public replicated journal of transactions would be ignored or undone by unaffected software. The malicious software and its damaged blockchain would form an unused fork.