For some people, this may indeed be a safer option if we consider that all the user needs is a username and password, and to be careful about phishing, with the hope that the exchange will not be hacked or that the owner(s) will not disappear/die and take everything into the unknown. However, a properly made cold wallet is still the safest, but it should be noted that hardware wallets do not fall into this category - you will still need to connect them to the Internet from time to time.
Mess up with a cold wallet? You can hardly do this if you are sufficiently informed, which leads us to the conclusion that any type of crypto wallet is not resistant to human stupidity - and now the only question remains whether a user will click on the phishing link or save their seed online (e-mail, cloud) and be hacked. As other members have already mentioned, Bitcoin isn't really yours if you don't have full control over your private keys - so I wouldn't even ask if one option is more secure than the other, but what is the correct storage method and what isn't.