If they are a legal entity holding customers funds, I say it's only fair that they are legally responsible for the funds they're holding on behalf of others.
They really ought to, if they cannot be held responsible for such, then they the exchanges can go ahead and frame a user up, sapping up his or her coins and claiming it was hacked. If it wasn't they who scammed the user, let them provide reasons as to why their system makes it easy for scammers to withdraw all the funds in a customers account.
I have a strong feeling the exchange know what went down with that funds, it's either a few exchange operators were working closely with the hackers and gave them the needed information to carry out their operation successfully, if it's discovered they have a hand in it, I think the exchange need to be charged and closed down.