If anyone (other than the project) could list a token, could it be messed up, or somehow be done maliciously?

Well it cannot be done maliciously but due to low liquidity (as the project itself didn't want to list the token yet and the project team not providing liquidity), many people will suffer from losses due to insane volatility because of low liquidity and if course losses due to swapping larger sums and receiving less due to low liquidity Basically: a shit launch of a token that went shit because the team didn't prepare it