Even KYC and AML can be faked by the hackers, because when they can hack the exchange what is the big deal in faking the documents and create a new account in exchanges and then hack it. So in real their is no big security which cannot be defended. It will take time to hack the exchange but it can be done. That is why it is not good to keep your coins in exchange if you are not trading daily. Even then you are insecure in any way.
Although hackers are very much active these days, yet we cannot just say that our funds in exchanges are not save because hacker have many techniques to hijack the exchanges system. It is also the responsibility of the exchanges to spend some good amount of funds to secure their system from hackers.