Besides applying security in various forms, the exchanges also need to be insured against theft and the like.
This is brought up frequently (insurance), but it's just not that simple. It's too easy to fake a theft and get the insurance to cover it.
I'm not saying it's impossible, just saying that such an insurer would need a very high level of expertise to prevent himself from being cheated. The insurer would need to require the insured eWallet to implement tons of security measures, and perhaps even use multisignature techniques in order to keep some control of the coins, I don't know.
I still think that multi-signature wallets, in which the eWallet costumer has one half of the keys and the eWallet the other, is probably the best solution. This would probably rule out the "old-fashioned attacks" that OP talks about, and a hack ripping off the entire wallet would also be extremely difficult. The hacker would have to install some clever malware in the server that would infect the eWallet users' machines and silently collect their keys, to spend everything only once he has most of them. And even that could be prevented with a browser addon, as suggested by Stephen Thomas in his presentation yesterday at London.
With such architecture, insurance would also be much easier: the insurer can be sure that his client cannot steal all the money.
