Now assume that i buy some bitcoins for now assume 3-4 bitcoins. Now since the user id and password is present with the coinbase or biance (centralized server). They can easily sell my bitcoins from my wallet. And I know going to the law in Europe is expensive and time consuming task which i do not want to do.
The problem is that these biance and other applications have your user id and password store on their server. And they know that we cannot go to the courts or law since it is expensive they can easily steal your bitcoin because they are big giants. And when you file a complain on them since they are so big they can show that you did legal transaction to some destination wallet address.
An important point to understand here: When you buy bitcoins on such exchanges, there is no real transfer made to you. Just like your userid and password, your balance is also just a number stored in their centralized database. Take this example to understand the things better:
Suppose, Person A deposits 5 bitcoins on Binance. To do so, he will send bitcoins to the deposit address shown in his 'funds' section on Binance from his personal wallet. Once, Binance receive those bitcoins, they will update the balance of Person A in their database and balance will start reflecting on Person A's account. Now, Person A sells 4 bitcoins on Binance and Person B buys those. Binance will then update the balance of Person B to 4 and Person A to 1. Important point to note here, bitcoins are
not really transferred from Person A to Person B. Bitcoins are still in custody of Binance, only user balance has been updated in centralized database of binance. Now, Person B has the authority to withdraw 4 bitcoins to his personal wallet. Person B can use non-custodial wallet and go to the withdraw section, place the withdrawal of 4 bitcoins. Once, the withdrawal is processed, Binance will update the balance of Person B to 0 and make real on-chain transaction to Person B's personal wallet.
So, the working of centralized exchanges work on trust basis. There are several instances in past when the exchanges ran away with users' funds. But like you are saying that they can make transaction to some destination address, they don't even need to do so. They already have access to your coins without needing userid, password or anything. These authentications are from user-prespective, site owner already take the custody of the coins the moment user makes the deposit.