The exchanges investing client money does not surprise me at all. I worked in UK finance for 6 years or so where you have mandatory "CASS" training to warn you what is and is not OK to do with client money. I remember when I first started I was like "well obviously you keep client money and assets separate from the corporate accounts..." and EVERY year in the "refresher course" our Compliance dept gave they had new cases of banks fucking this up and getting insane fines for it [0].
If these supposedly respectable banks managed to repeatedly do this (this is after the financial crisis btw) then it's anyone's guess what goes on in the Wild West that is Bitcoin exchanges. That said, the stupidity and lack of common sense in UK financial industry continues blows my mind.
[0] - https://www.moneymarketing.co.uk/why-the-fca-rewrote-the-rul...