Much of this is because of forks - since they offered Bitcoin before the BCH fork (and presumably ETH before the ETC fork), all of their customers who owned one of these before the fork also own the new currency. So they have to support custody for the currencies anyway (unless they want to deal with angry customers saying "What happened to my BCH! Rightfully I own it"), and if they don't support trading they'll get angry customers that say "Why can't I sell my BCH?!?". (This is aggravated by potentially needing to send that BCH off to another exchange, potentially not in the U.S, with worse regulatory compliance, in order to sell.) So most of the work needed to support it has to be done anyway to remain in legal compliance, and it's a small amount of additional work for a large benefit to support trading.

Huh, I would've thought that since people will pay over 300 usd for one Bitcoin Cash coin (according to 3 web sites I just sampled), there would always be plenty of miners competing for them.

The infrastructure to carry out that attack against BCH would cost around a billion dollars in mining equipment and power. Not exactly what you would call a small miner. BCH also has rolling 10 block checkpoints so max you could reorg would be 10 blocks or < 2 hours of transactions.

In reality there is nowhere you could rent this hashpower and miners that do have it would never risk the legal, social and monetary consequences to rollback 2 hours of transactions.

That's not a great one, Nintendo started out as a playing card company after all. Where you start is quite irrelevant. It's where you end up that matters, and I think MtGox demonstrates that quite clearly.