Anyone who willingly opts into staking on a shady exchange, agreeing to a contract saying that they might be slashed, needs to be prepared to be slashed.
On the other hand, any exchange that automatically opts user deposits into staking without notifying them should be criminally liable. That's a big breach of user trust.
One of the selling points of cryptocurrencies is that they make financial transactions and contracts possible without depending on a central authority.
I never realized this could even happen. And this is a HUGE problem for PoS if I am understanding this correctly. Because Exchanges don't even settle the transactions that often on chain, and could totally do this without user knowledge and then say they did with someone else's coins. You can't even prove it.
The problem of exchanges not keeping proper liquid reserves has nothing to do with PoS. If they stake customer ETH without permission, that ETH leaves their full custody and therefore they are lying to their customers about their reserves, and operating a fractional reserve scheme.
Since the cryptocurrency "big bang" in 2009, it's always been the case that you have to trust your exchange not to run away with your deposits, because they can show you whatever balance they want on your screen regardless of how many coins they actually own on the back-end.