1) Security 1a) Compliance ... 57) Customer Service
While annoying, this was both sufficient and necessary for the business to date. Security is necessary for obvious reasons. Compliance is necessary because to be able to do business with US banks (card processing, ACH, wires...) they had to be aggressive about complying with US regulation. Which ultimately gives them an advantage on the customer service front relative to their competition for retail investors. And frankly, they aren't much worse than most online brokers.
These priorities were also sufficient. Amazon was competing against major incumbents and had to win on cost and service. By outcompeting an empty field on compliance, Coinbase has built a significant moat around US retail. They have relationships with Fidelity and USAA that signal legitimacy. They had cold storage while incumbents were/are still saying 'blockchain not Bitcoin'.
The critical question is how they manage customer service and communications going forward. Amazon, Facebook, and Google created monopolies based on a great user experience. Uber destroyed a thousand monopolies for the same reason. Coinbase is riding the coattails of Bitcoin's awesome UX, the warm fuzzies people get from making 10x on an investment. If and when there is a correction, their core business will hinge on how well they handle a large sell-off.