The smart contract is place, but they can upgrade it?

They moved to a new smart contract. They didn't/can't modify the old smart contract because well, it is a smart contract. They decided to tweak a few things to make the system even more perfect and we just shift our tokens over.

How do you know that they will not upgrade it so that you lose all of your money?

well, it has been certified by Callisto Security Network, go check the github and you'll know. However, do ur own research. You can even check the contract urself if you're skeptical and see that they can't take your money and anyways, your divs are paid in ETC which can be withdrawn anytime.