Because exchanges are a primary target for hackers and get hacked all the time. When you leave a crypto currency on any centralised exchange, you technically don't own it, since you don't hold the private key to the wallet where it's stored, the exchange has it, and that's what hackers are after so they could move that crypto out and into their own wallets. And every now and then, they end up running away with "your" crypto. You're only safe (relatively speaking) if you (and only you) hold the private key to your wallet and no one else. That's why you need a cold/hardware wallet like Trezor, Ledger Wallet or KeepKey - there are other methods of course to hold your private keys but these are very secure and practical - anything else, is playing Russian roulette with your crypto.