they are not decentralized.
Centralized and decentralized is something different. Centralized refers to usually a single point of failure. For instance, if Binance's website gets hacked or taken down, you won't have access to your account any more. Because their single point of failure just failed. An exchange like Bisq, on the other hand, is decentralized. It doesn't have a central server somewhere that must store a copy of the software. Hundreds or thousands of people run unique copies on their computers and connect to each other P2P. The disappearance of 1, 5, or 50 computers doesn't result in any downtime because the peers that are online can still trade normally. And if I wanted to take Bisq down, I would have to prevent every single computer in the world to run the software. With the Binance example from above, we only need to make the website disappear.