If the funds in her exchange account is being used for active trading, then it could also be viewed as illogical and not knowing proper bankroll management.

Note that comfortability (e.g., storing your funds in exchange) can fully compromise the security of her funds being stolen. It could be an insider, a hacker or even just having some malware in her computer. Much worse if your friend has literally no idea on how to protect herself from various attack vectors such as phishing, weak credentials, ransomware and so on and forth.

See this list if your friend still not believe that exchange hacking incident are happening.
[1] https://hacked.slowmist.io/en/