You know the answer to that. You are the only responsible for securing your PK. If XAPO is doing something like that to you then it's for securing the forked coins but in terms of handling your assets is another issue.