The exchanges are centralized by nature, only recently the first decentralized exchanges are showing up.
On top of been centralized, they need to have FIAT accounts and that is the "point of attack"