You are completely right, I dont understand why people in this market put so much trust into these various exchanges holding all their crypto assets when there are major security flaws at play. You have hackers, frauds in these organization, etc.

The best thing to do is generate an address offline by saving the bitaddress.org to your desktop, and then printing out the QR code to put in a safe place. I wouldnt even trust another hard drive or USB product like trezor. Also, Coinbase is a government regulated exchange. If they dont send you your funds you can technically hold them over the fireplace for it.