One token, one vote is a design choice, not a default
The most common governance model weights voting power by token balance: hold more tokens, cast more votes. It's easy to implement and hard to game with fake identities, since minting a thousand new voters costs real capital rather than just registering a thousand new email addresses. But 'easy to implement' is not the same as 'neutral' or 'fair.' One-token-one-vote directly imports the token's wealth distribution into the governance process. If ten addresses hold sixty percent of the supply, those ten addresses can outvote everyone else combined on every single proposal, regardless of how many total holders exist or how they feel.
This is plutocracy risk, and it's not a bug that slipped through, it's the direct, foreseeable consequence of tying voting power to capital. Large holders (early investors, founding teams, exchanges holding user deposits) can end up with outsized influence over protocol upgrades, treasury spending, and parameter changes, sometimes enough to pass proposals that benefit themselves at the expense of smaller holders. Some governance designs try to soften this with quadratic voting (cost of additional votes grows faster than linearly) or reputation-based systems that ignore token balance entirely, but both introduce their own attack surfaces, like sybil attacks against reputation systems that don't have a capital cost to defeat.