c++ code makes it possible to control the whole system since there is no 3rd party code for databases, webservers and libraries in the exchange backend used.
having to rely on 3rd party code makes it simple to attack the site if a 0-day exploit is found for any package.
finding a 0-day for custom code is almost impossible since you have no access to the source to analyse it in depth to find useful attack vectors.

beside of security it runs much faster than anything else and can be optimized for requirements like thousands of transactions per second or in memory data verification.