making an exchange can be easy, but then promoting it to have enough users and securing people funds can be a ve difficult task.
This is where you're wrong buddy. Getting people to actually use your exchange and securing their funds are just few of the many challenges you're going to face. Sure making the exchange itself might be "easy" if you have low standards and just want an exchange that's technically running but could barely run consistently without problems.