I wouldn't call coinbase and localbitcoin (web-)wallets as 'standard to use'.
The standard should be to have access to the private keys. And to be the only one who is able to access them.
With webwallets you are giving the full control to the sites operator. Its not only another attack vector. You are completely relying on them to secure your (potential) coins.

Paper/Hardware/Desktop/Mobile wallets are necessary to store coins safely.