Hacking is often not the work of actual hackers, there are insiders involved or also used as an excuse to make their business look clean from dirty employees.

The exchange is only a place to exchange or trade, if it is used to store coins there, those who do it already use it not according to its designation, it could be because they are lazy to learn about wallet security so they prefer a simple one, which they will pay dearly for by losing their assets there.