In addresses that the "Upgraded" event fired before, we can find the new version's code using the implementation address and check the amount of change on the code using some code diff algorithms.
In addresses that the "AdminChanged" event fired before, we can check if it changed from EOA to Multi-sig or another EOA or a governance structure.
Don't forget to check for Pauseability and TimeLock and other stuff
Add security discussion
Add evaluation framework
Sample code