You are right, if your the exchange has your keys, they own it. But people should be able to trust exchanges when they are protected by the law. At least during the transaction process, after that, they should move it to their own wallet.