I'm pretty sure it completely depends on how careful the exchange stores their data. If the exchange's security sucks, and you have your credit card info on your account, then they could
probably use your funds to buy bitcoin and send em out to the hacker's wallet.
This is precisely why it is good to stick to the biggest exchanges. They are mostly the safest choice. Gemini, Bitstamp, and Coinbase/GDAX are good choices imo. For alts, binance has risen in popularity recently.
Coinbase is good, sure, but always remember to not store big amounts of bitcoin/eth/ltc on Coinbase.