As long as users don't care about security, the exchanges won't care as well. Once users care enough, then the exchanges will. I think crypto exchanges are demonstrating a flaw in our society's approach to security where people have been conditioned into seeing hacks as inevitable and being taught to expect to live with the outcome and have ways to dampen the impact (credit monitoring, credit cards that detect and auto block fake transactions, etc.). The problem is that, at least for now, there is no dampening impact with crytocurrency. One hack and you lose everything, with nothing to reduce damage.