It's true that 'not your key, not your coin', and that there are several wallets and services available to cover yourself.
There may be a point at which any cryptocurrency (whether Bitcoin or another) is held on exchanges/wallets run by small/new companies.
The small players have limited resources. How do they ensure they are sufficiently protected? Why don't there be hacks every other day?
Depends on the person. There are some people who lost access on their coins multiple times despite the fact that they had control on their keys and for these type of people, exchanges are really better options.
Overall, refund in case of hacks, depends on the exchange. I guess as serious exchanges as Binance and Coinbase are, will refund you in case something happens and as I have heard, Binance was also refunding money to those who were liquidated because of Binance's error (those who set stop loss order and it wasn't activated). I remember cointelegraph was writing something like that.