Staking itself wouldn't be a problem. There would be some risk involved in case of technical problems (for example due to Slashing on Ethereum), but in overall that risk should be relatively small. Exchanges could still hold all of the coins, but just use some of the coins for staking (if users owning the coins opt-in to staking).
The problem occurs when exchanges lend out stored coins without the approval of the user: Either to lend them for shorting or to invest them into something that they assume would appreciate faster.