The hacking risk is not really the primary reason for not holding your crypto on exchanges. For example, that's not the motivation behind the proof of keys event that happened recently.

The real reason is that whoever holds the crypto has the power. If an exchange holds an enormous amount of crypto (as most of them do), they have an incredible amount of power over those crypto networks.

For example, one of Bitcoin's most important points is that there is a limited supply which cannot be increased. But any crypto exchange today can increase the supply of Bitcoin significantly if they want, and we don't know if they are doing it or not (which probably means at least some are).

The reason they can do that is because they can put in sell orders on their platform as much as they want. They don't actually have to have the crypto that they are selling. In that case, people who buy the crypto they are selling aren't actually getting anything, but as long as they hold their crypto on the exchange, they don't know that.

The point is that the amount of bitcoin people have on an exchange is just how much the exchange says they have. As an example, say an exchange actually owns 10,000 BTC in their wallets, but the sum of all of the BTC balances in user's accounts is 20,000 BTC.

This could be the case right now and we have no way to know. As long as people keep holding their BTC on the exchange, this all works fine, and the exchange can keep adding more supply in this manner. The only way to stop this is if everyone withdraws their crypto from the exchange. If users have 20k BTC in their balances and the exchange only has 10k BTC, and all the users try to withdraw, only then will this extra supply go away.

This is exactly what banks do with USD, and with stocks (see the Dole food case for example, or look into why Patrick Byrne of overstock.com is into crypto). That is the reason behind movements like proof of keys and why Andreas and others say "not your keys, not your bitcoin". It's not because of hack risk, it's because if we think we have crypto because an exchange says we does, we have no way of knowing if the exchange actually holds that crypto to back up those balances and it gives the exchanges power to manipulate the supply at will.