Even if they could steal your bitcoins, I doubt they're stupid enough to do that. Imagine how it will affect their business and consumer trust. Sure, they can simply brush it off by saying "we don't steal it, maybe somebody cracks it", but I don't think they'll go full Mt.Gox.

What's more concerning is how you can prove that the one who 'steal' the money is really them. It's nearly impossible to do it, which is why I don't really like custodial or semi-custodial wallet.