DeFi exchanges, as you call them, don’t take custody of user’s funds
Can you prove it? From my experience with DeFi, the software is closed-source. You can export private keys and the like, but you can't know with certainty if another entity holds your keys as well. And in my opinion, if another entity holds my keys, it isn't self-custodial, regardless of what I do.
Uniswap which is the biggest DEX, and the one which most other DEXs base their code on has been open source from the beginning. Starting from V3, their code was released under a business source license which meant it can be reviewed but not copied for commercial use until after 2 years when it becomes open source.
Nobody holds the keys to your wallet but you do have to give permission for smart contracts to pull a specified amount of funds from your wallet. By default the limit is usually set to allow an infinite amount of funds that can be used by a specific contract. If the contract is immutable and developers renounced ownership, which can be done by setting the owner to a burn address, then there is very minimal risk of getting rugpulled.