"Not your keys, not your coins" works well in the past, now and in future.
Yep, the original slogan is cool, too. But have you read what I wrote? 
What I meant was, in line with the topic of this thread: if you purchase something labeled as "BTC" and you don't get a private key for it, then it's not a Bitcoin, but something else
It may be some IOU from a CEX or another bank-like intermediary entity doing fractional-reserve banking, or a wBTC-style wrapped token where the backing Bitcoins in theory can be stolen, etc. You have no guarantee that it's 1/21000000th of the Bitcoins in circulation until you get a private key and the BTC are "sitting" there.