Well until CoinBase is hacked and there is nothing left FOR you to withdraw.

Just as with fiat USD, depositing it into any third party that is not FDIC is silly. Same here, however there is no FDIC like entity to return your money, so the only true secure way is to only hold them yourself.

Of course that makes mass adoption much more difficult...

Until Gov. Treasuries and central banks really jump into the game...