I think people (perhaps rationally) believe that the people running the exchanges know more about keeping bitcoins secure than they themselves do. The analogy would be that you're a lot safer putting your money in a bank than trying to keep it safe in your house. And certainly a company whose entire business is trading in bitcoin
should know how to keep them safe. Unfortunately the reality is obviously sometimes different.
Certainly you can keep your own coins essentially 100% safe relatively easily with encryption and backups, but most people wouldn't even think to try, let alone have the necessary knowledge to do so.