Monitoring deposits based on the TXID is not the most efficient way about doing it. It would just cause unnecessary delay for the user and it would be a headache for them if the user decides to RBF due to low fees and whatnot.
It would be annoying for the company to handle hundreds of support messages regarding uncredited deposits due to the malleability issue.
it is actually the laziest thing to do and considering the fact that many newcomers don't even know what RBF is i don't suppose these bad services get that many support tickets not to mention that they don't have that many users to begin with.
that may be the main reason why they haven't fixed their broken system.