Yes, and I mean I think that's exactly the point: people aren't expecting their exchanges to be a bank that puts their assets at risk, they're expecting them to be a custodian only, and ding them with fees when they trade, or possibly to actively charge them fees for holding deposits. The only reason actual banks get with putting customer funds at risk is that deposits (up to a certain point) are insured by the government.

If the exchange wants to offer interest-bearing deposits (eg: loan out your crypto), well then you'd expect to no longer be able to verify your deposits because you'd know they were loaned out, or that the exchange was trading with them, or whatever else. You'd also be forced to confront the fact that your assets are at risk at that point.