I've read criticism that Coinbase goes against the spirit of bitcoin, since they control the private keys. I disagree now. I think free off-chain transactions and the ability to allow third-parties to directly debit your account is critical. To implement these features, they need to hold the private keys.
As long as if and when Coinbase is hacked you don't go complaining and suing I've got no philosophical problem with the concept. In my mind buying the best home security system on the market and then posting your address and passcode online would be a silly thing. But that's me. It's a fine line between cautious and paranoid.
When I switch from thinking of Bitcoin as an investment to a currency I will probably keep a little in a live exchange. About as much as I keep in USD in my wallet I figure. By then the technology will have matured a bit as well (as will the hacking techniques <sigh>)
One must balance ease of use with how much one is willing to lose.
It all comes down to personal choice, which I think is the one thing we all here can agree on