the platforms that support the airdrop are stakecube and midas, all the other exchanges do not, so those who have the coins on crex24 or latoken most likely will not receive Graphene but I believe that the exchange will take the airdrop.
As an exchange, they know how to claim airdrops and just lazy to support customers or being greed to steal your coins. I am aware of risks when expose private keys to claim airdrops but exchanges can not blame on it when they reject to do this for the benefits of customers. In addtion, that behavior only makes their reputation worse. If there are other exchanges that generously and kindly support airdrops, not only for PHR or Graphene but also for other altcoins, people will chose it.
Not your keys, not your coins. It is true for bitcoin, altcoins, forks and airdrops.
This is a prime example of why you should always own your own keys.
sidenote, the phore > graphene airdrop wont require you to reveal private keys, it's going to be done with a signed message, so I don't think exchanges will be compromised.
Hopefully the team are successful at removing the assoiciated wallets from the drop