Have you considered the following two possibilities. First, they may not be legally allowed to tell you much. Second, if they reveal all the things that flags their system then it becomes easy to bypass it?
You tell that to the people who have lost life-savings, life-changing amounts to these scam exchanges. You tell that to the clueless customers who forever wondered what happened to their hard-earned money. They got no proper explanation, no response even.
The possibilities you're talking about are the most convenient ways for these scammers to steal money. Forget about legalities. I'm sure these behaviors and alibis can't stand in a court of law. If only it's easy to bring these scumbags to court.
Yes, I will gladly tell them because they are the ones at fault...
Everything is the user's fault...
I don't know if you're currently or used to be a developer, staff, part of the team, or whatever of an exchange, but I don't agree with your view. You'll probably stick to it. I'm not here to convince you otherwise, anyway. But I don't think it's fair; to be guaranteed that your funds are safe, for example, but were suddenly frozen for no reason at all.
Cases were filed, although most of the time, it isn't practical to do so considering how costly it is to really pursue a company based in the Bahamas or Seychelles for a mere $500 or $1,000 or $5,000.
Let's just agree to disagree I guess if you really think everything's the user's fault. But you must have heard of FTX, QuadrigaCX, Cryptsy, and many others. There's fraud. There's mismanagement, lack of security, negligence, and the like, but, yeah, the users are the ones at fault.