All bots that have been verified can be used in that way a server owner can prevent this by disabling slash commands. However a person can still take something from your server and manually submit it to the bot somewhere else same as always.

I mean discord isn't partnered with them its just a bot that you or those with admin privlages can invite into your server.

you can ban anyone like that regardless of if that someone is in the server. A ban just means the ID was added to the ban list not that they've been kicked.