I know it's counterintuitive, but for newbies/ordinary, non-hardcore users it's better to use a mixer, or a CoinJoin application that filters out hacked/stolen coins if because they merely want privacy and untraceability.
For a wallet to censor some inputs as Wasabi is doing, then they must first choose which inputs to censor. They can only do this if they spy on
every input, trace where it is coming from, who owns it, etc., in order to choose which ones they decide aren't good enough for them. If privacy is your goal, I would stay well clear of Wasabi, since they are now using your fees to pay blockchain analysis companies to spy on you.
What would you say to them if they're coins are withheld by an exchange because of taint?
I would reiterate that they shouldn't be using services which will confiscate their coins.
How far does this taint usually go when it comes to centralized exchanges?
Anybody's guess. Every exchange has their own set of secret algorithms that decide what is tainted and what isn't. It is completely arbitrary. Pretty much every bitcoin in active circulation could be tainted if you look back far enough. What I consolidate 49 clean inputs with 1 tainted input, and spit out 50 new outputs. Are all of them tainted? Perhaps they are all 2% tainted? What if my tainted UTXO moves 5 times? 100 times? 10,000 times? Is it still tainted? What if Coinbase accept a coin which Binance thinks is tainted and sweeps it in to their hot wallet. Does that make every withdrawal from Coinbase tainted? Completely arbitrary and completely meaningless.