The problem is that more than half of the XEL are in one wallet, which is Bittrex. If this wallet gets hacked then Elastic is dead, for sure.
It IS unusual that more than half of all coins are in a single hot wallet. If you hold XEL and do not worry about that situation, then you are naiv.
EDIT: Nobody knows how many people at Bittrex have access to the password of their XEL account. Exchanges have been hacked before.
This is quite a common occurance with newer projects that haven't been around long enough to be listed on more exchanges for a better distribution, in time with more adoption it will change. If Bittrex got hacked there would be bigger problems than just for XEL but in crypto anything can happen. I agree it is always better to keep your tokens where you actually own them and have full control over them.