This would require to perform any exchanging on the respective blockchains, which is not how most crypto exchanges work, for various reasons (performance, cost,

This would require to perform any exchanging on the respective blockchains, which is not how most crypto exchanges work, for various reasons (performance, cost, missing atomicity across different blockchains, involvement of non-crypto currencies, ...). The ones that don't implement this centralized model are the decentralized exchanges like BitShares or Etherdelta. Those however can't deal with actual fiat currencies and they suffer from serious performance weaknesses, effectively resulting in them having much less volume than the big centralized exchanges. But they are pretty secure when it comes to hacking attacks - actually, if done right, they also work pretty much like you explained it, with the users holding the keys necessary to access their funds while they're on the order book.