Exchanges establish their own fees. The fees are different not only between exchanges but sometimes between different trading pairs on the same exchange. Use a free service like Switchain to compare rates between a few different exchanges for each individual transaction.
There are custodial and non-custodial exchanges. Put simply, the first ones hold onto your assets that you leave with them which is what makes it vulnerable. Once it's hacked there's nothing you can do but watch. Non-custodial ones only hold your assets for the time necessary to complete the exchange.
Hope this helped.
I do think that every exchange out there is vulnerable to any attack that will come hackers, though some of them will be difficult and be able to withstand attacks to a certain level. The very first thing you should have in my mind is to not buy from a place that will disappear overnight. After that, consider your location and the exchange that is best for your location.
Next is the level of security, you need one that has a strong level of security just like Coinbase. Maybe this will help you choose, read this article on CNBC
https://www.cnbc.com/2018/03/21/how-to-pick-the-best-cryptocurrency-exchange.html