Why would it be any different to traditional exchanges?
They hold funds on behalf of customers, and if they get hacked they can lose it permanently, that's true. But it doesn't mean the exchange itself needs to have a position in the market.
If they did see arbitrage opportunities they are engaging in risk (there is timing risk for example) and I'm not even sure they could legally do this as deposits should be ringfenced.
This fact exposes them to theft and something akin to a bank run, where withdrawals can exceed deposits, something that can never happen on the NYSE because it doesn’t hold inventory.
> the exchange effectively has a position in the market too, unlike traditional exchanges like the NYSE. They have to buy bitcoin from other exchanges
Exchanges don't have to buy bitcoin from other exchanges, and exchanges don't necessarily have a position in the market.