Generally, the private keys are kept by the exchanges stuffs or managers, there are risks that the exchanges will take away your coins, but I think some big exchange will not do that since they can make great profit to keep the exchange safe, instead of taking the coins away for a short time profit.
I agree with you. for example, take a stock exchange binance that very much values its reputation in particular security. and recently it was hacked twice, but it was not possible for the scammers to steal (as far as I know) and they will compensate them in case they steal. by itself on stock exchanges garbage and catch nothing