What you said in your last sentence is the correct way to do it. Don't trust any exchange. Use them for that purpose only. An "exchange".
Remember "Not your keys, not your coins." Let's not forget that, please.
Whatever coins we hold, let's look for a wallet that supports it first because that's the only security we can have from all these scams that are happening left and right. Without that, we are prone to anything.
But, how will you use them if you don't trust them? And an exchange has different purposes or functions which can include trapping our funds for a certain period time to gain a return. Not all exchanges are centralized but there are also decentralized. However I think they still has a risk so we should be careful. Same goes to the crypto wallets. Having our own keys is not the only security that we can have but we have others too like setting up a 2FA, and so on.. We need to do them as well to have an extra layer of security.
The worst case scenario that I am imagining is your asset suddenly gone in Paypal or any exchange and they can still prove that you don't really have anything in their wallet. That will be fucked up because we cannot fight a battle against big companies like that.
That's indeed worse, and it's not different from scamming already. Aren't they afraid with that? If they continue like this, many people will soon not use their service anymore.