The probably I see from reading forums is that exchanges have a pattern of locking accounts at time of withdrawal and not being transparent about concerns at time of deposit.
This is exactly the case, and it even extends beyond that. You can deposit coins freely, and you can even trade coins indefinitely, making the exchange money via maker, taker, and other trading fees. It is only when you come to withdraw your coins that you are suddenly hit with locked accounts and invasive KYC requests. We see the same pattern of activity across multiple exchanges over and over again. The only way to be sure of avoiding it is to avoid these centralized exchanges altogether.
What legal authority would they have to ever hold someone's funds demanding information as to the source if they are insinuating coins are tainted?
Every centralized exchange will have something buried in their Terms of Service saying that if you trigger some unspecified automatic algorithm which they will never provide any details of, then your account will be frozen/locked/suspended pending review and/or you handing over ridiculous amounts of private information. By signing up to the exchange, you signal your acceptance of these terms, and grant the exchange the ability to do whatever they like to you, your account, and your coins.