BR could have started from the beginning with self-custody, but they didn't do it - what do you think for what reason? If they were capable of doing that, they wouldn't have entrusted the job to someone else, and no matter how strange it sounds, that someone is still a professional in that business. CB has very strict criteria when generating wallets, and also regarding the storage of private keys - there was an article a few years ago that described the entire procedure in detail.