Even KYC and AML can be faked by the hackers, because when they can hack the exchange what is the big deal in faking the documents and create a new account in exchanges and then hack it. So in real their is no big security which cannot be defended. It will take time to hack the exchange but it can be done. That is why it is not good to keep your coins in exchange if you are not trading daily. Even then you are insecure in any way.