It's just a matter of time (and money,) before privacy laws catch up to security laws. For now, there are little ramifications other than class action law suites when a bank or exchange suffers a data breach. The expense of securing customer data is likely still more expensive than the occasional penalties of a data breach. That needs to change.
The bigger issue in my opinion is banks and CEXs taking it upon themselves to babysit their customers' funds. Like the story of in the OP about the guy who missed his rent payment due to the exchange holding a withdrawal. That's inexcusable, and no politician will tough that one.
We just can not fully believe in any corporations, companies, platforms in all industries, not only in cryptocurrency and centralized exchange industry with our privacy and funds. They might or might not spend enough resources for their system and platform security but it is never enough because hackers will always try to do their works and after many attacks and efforts, they will succeed sometimes.
Assuming when we send documents out of our homes or computers to any company, we lost it forever and which security system such company has is not matter.
It's the same with fund stored on centralized exchanges that can be seized by governments, be scam exited, hacked to deaths, many reasons. Counting dead exchanges is not easy.
https://www.cryptowisser.com/exchange-graveyard/