1. why are they not securing customers funds in the same manner as their own reserves, for them to think customers funds could be lost but their reserves could not be
Now this is a really good question
Another question is how can Xapo be certain its own reserve is enough to cover hacked customer funds? I doubt Bitfinex had a reserve big enough to cover the customer funds it lost. Most companies pay their shareholders the lions share of their profits, they don't save enough to cover huge losses. Most banks don't save enough to cover huge losses, and why should Xapo be different?