I do not prefer any. I would rather buy on the exchange. Lots of ICO today do not get into exchange and lots of investors that invested on that project are frustrated because they suffer heavy loss due to this thing. Though there is an exemption such as, if the group creating an ICO is well established and known in the market.
if really want invest in coin/token from new project i'm prefered to buy after they listed on exchange, because like you said, i don't want take a risk for investing money from untrusted project and developer