Hacking is the biggest risk in getting involved in crypto, imho.
In terms of sites and services, it's not hacking, but inside jobs being the biggest risk factor. In current time and day it's easy to perform an inside job and blame hackers for exploiting a security hole in their platform.
Fact of the matter is that services shouldn't have that many coins sitting in hot wallets. Especially, in case of NiceHash, there is nothing in the world that justifies them to store that many coins in a hot wallet.
It's either done on purposely, which I believe is the case, or done because of their stupidity and incompetence. It must have felt very warm considering them being responsible for taking care of that many coins.
Even so warm, that they believe that they can just take it at cost of all the people having been totally dedicated to that platform. It's again a costly lesson for people that (when possible) withdrawing funds is always a necessity.