To start off my post, if you don't have the private key, the keys aren't yours.

That being said, the security issue lies in the fact that you don't truly know if an exchange has your coins offline. As we saw from the Mt Gox incident, coins were all online at some point, prone to be stolen by a hacker (which apparently did happen, at some time in Mt Gox's history), so there's your risk. As we know, someone with resources and time can do pretty much anything on the internet.

Even if your coins are offline, you have to trust someone from the exchange isn't simply going to run off with them.

I'd say the risk of a Mt Gox-like event isn't high, but it's not impossible and there doesn't need to be another Mt Gox-like fiasco for your coins to be stolen.

The system will never evolve in the direction of banks. The objective of the system is the exact opposite, and a bank is definitely not safe or "bulletproof".

I hope my post is clear and a valid answer to your question, at at least to part of your question.