How do websites like EtherDelta and Idex.Market sell third party ERC20 tokens

[Alex Brend]

Do they purchase these tokens in a limited quantity and then sell it, or the tokens are available to buy once they have been published on etherscan?

I am confused because how are they able to transfer these tokens from User to User like a c2c transaction? Don't they need ABI and key of owner to interact with the tokens?

[loloy]

EtherDelta, ForkDelta and IDEX crypto exchanges are decentralized, meaning, no one can manilupate the exchange walls but somehow they're not that reliable unlike big crypto exchanges like Binance, HitBTC, Poloneix, GDAX etc.
recently EtherDelta was attacked and accounts were stolen and so as big crypto exchanges but the users on popular exchanges will be refunded in case the coins lost unlike decentralized exchanges mentioned above.