> compounded with the fact that you still have to securely store the credentials to access that exchange anyway.
Not entirely correct. For the Kraken account, 2FA is a must AND you will still have to enter a code send to Gmail if you connect with an unknown IP address. Even if the PC would be compromised it is impossible for the attacker to send funds anywhere because for this you have a second 2FA.
If you want to send money to a different account (does not matter if $ / € or ₿) you also have to verify this by E-mail and 2FA code.
My mum is a good example for a no tech person. You can't imagine what I have been through. To even think she would remember after 3 days, where she stored the keys, after 7 days that she needs them at all and finally after 14 days that I have ever told her anything about it.
There are MANY people, where the exchange is the best option. I could go on with other examples, but my mum is a prime example of a non-tech person. For my mum, Internet Explorer is not a browser, but "the button to the internet".