This is pretty much crypto, you're always due to do your own research.
We've seen 'legit' projects such as Oyster Pearl going down the drain and projects that were assumed as scams turning out legit.
It's definitely becoming more difficult to know which projects are legit now. Since a lot of the time only the person at the very top knows about the impending scam, leaving the others to pick up the pieces.
Exchanges can't really be blamed for listing tokens that turn out to be scams, since most of the time it is practically impossible to know in advance as for all intents and purposes the projects are a success until the scam.
Indeed, there have been cases in which even everyone working on the company got burnt. I'm pretty sure individuals working for Oyster had no clue of what was going to happen.
The most exchanges can do is a thorough study of the whitepaper and a detailed check on the team background.