Are you trying to comfort people into thinking it's safe to use because no one can withdraw their funds?

With people's API keys you control what happens with their funds on-exchange, and while you can't withdraw using API keys, you can use people's funds to pump a shitcoin that you bought into, and then dump everything and withdraw through your own account. Binance stopped such an attack not that long ago, do you remember?

Noobs don't have any understanding of how to fundamentally break down code in order to search for backdoors.

I'm not saying you are doing the same, but be aware of how much of a target people are.