By creating centralized points of trust, you provide profitable points to attack, ...
That's no different from MtGox now. MtGox and other exchanges are profitable points to attack, which is why they have been. However, that doesn't stop exchanges from continuing, with lessons learned and better security.
... either by people who want to steal the bitcoins, or governments or companies like PayPal who might want to damage Bitcoin. Compare to peer-to-peer file sharing, the centralized ones were attacked successfully, the decentralized ones are nearly impossible to stop.
Note that adding BCH's on top of the network doesn't replace the network. The core network and coin options remain, so things are still decentralized and impossible to stop (without shutting down the Internet).
When I say attack, I don't just mean hacking, in fact, I see hacking is the smallest problem. Undermining people's trust is a much better attack. If a large number of people lose a significant amount of fiat and/or bitcoin, then it still looks bad for Bitcoin from an outsider point of view, even if the cause was nothing to do with the Bitcoin network.
For instance, it would be easy to set up a system like you suggest, get as many people as you can to deposit, and then delete your private keys so that the funds are impossible to retrieve, and claim you got hacked or some other story. Or, for added effect, delete the keys and tell everyone that's exactly what you've done (assuming no legal ramifications) just to add insult to injury.
If the Japanese government decided that MtGox was doing something it didn't like, like enabling money laundering, it could force MtGox to cease trading and seize all of the fiat and servers.
Anyone with an account there would potentially lose everything in their account, pending investigation.
I don't think that people would shrug it off and move to another exchange - they'd seriously consider quitting Bitcoin altogether if they lose significant money or have to fight accusations of money laundering.