no exchange should ever have a privkey online. there are many ways to still service people without having private keys on their server
no exchange should have peoples passwords stored in clear text.

but with that said, most exchange hacks were never hacks, just plausible denyiable excuses for the exchange owners to take the funds themselves and point the finger into space at some distant galaxy where anonymous hackers cant be found