I think in order to protect the users o the exchange, they need to set some insurance for the accounts if it will be hack so users accounts will not be affected, just like what SAFU funds of binance did, but if exchange is not as big as Binance, then maybe they can find an insurer to insure their site.
Even the best ones have been exploited out which mean all exchangers do really have the risk.
The thing here is that its hard to consider on having an insurer or some will built up this thing yet they do know on how big is the damage would be dealt if there are
a certain hack happened.No business nor legal firms will tend to jump in to this matter.