Even in your example given above, if we assume (and it's a big if) that the exchanges are genuinely and thoroughly auditing every one of these tokens and their

Even in your example given above, if we assume (and it's a big if) that the exchanges are genuinely and thoroughly auditing every one of these tokens and their respective implementations - they're still at the mercy of any and all future bugs that might be introduced non-maliciously in the future. Sure, they can delist a token if they want to, but that's far from an instant switch and they most certainly would have an off-boarding process for their customer's balances that would not keep pace with a critical exploit in the wild.