Or they're a tiny company trying to push in all areas at the same time, and they have to prioritize, and sometimes things they'd want to do fall through the cracks or they just haven't had a chance to do them yet. If you've ever been at a small company, you know that this is the much more likely scenario. Requiring them to have already implemented all of the security measures of Paypal, which has been around for more than a decade and is orders of magnitude larger than them, is sort of ridiculous.

If you don't trust them to hold on to your coins, use them purely an exchange and then pull them off onto an offline wallet.