"Force majeure" is a general term that encompasses a lot of different circumstances. I've never seen a policy exclude risks due to "force majeure" without defining precisely what those risks are. And in my experience, risks like war, riots, and civil unrest are usually excluded, while risks like flooding, fire, and other natural disasters are usually, but not always, covered.
I would not characterize kidnap, ransom, and extortion as force majeure.
And the whole transaction malleability issue - that might make a good insurance coverage case! (Which would be good for people like me, bad for everyone else.)
It is not hard to protect yourself from malleability issues. I would highly doubt that coinbase wold suffer any losses due to malleability.
When gox disclosed their losses due to malleability, other major exchanges temporary suspended withdrawals, however none of them were vulnerable and were able to resume withdrawals without changes to their processes.