Another option is to ask users (offer creator) if he wants the deposit to go to the Bisq donation address, TOR foundation or to be destroyed.
The 2of2 and donation address relies that there’s little incentive going to arbitration and these cases should be rare. It think that this post makes a good point, XMR volume is high ennough and if the Bisq donation address manager wants to scam Bisq, it’s possible because there’s no bond high ennough to stop this. Multisig for the donation address is a good idea, collusion is harder when involving multiple parties.