The disincentive to scam is the same thing that gives exchanges from investing in sufficient security to prevent themselves from getting hacked. If they get hacked even one time and cover the losses then customers will not have confidence in their security and will look elsewhere for trading