What? I just checked news last week and there was a small thing about an exchange called FTX that seemed to have exactly this problem.
Once the custodian is allowed to do anything that causes the exact tokens a customer deposited to be exchanged for another asset, that opens the door to FTX-style malfeasance.
If the exchange wants to offer interest-bearing deposits (eg: loan out your crypto), well then you'd expect to no longer be able to verify your deposits because you'd know they were loaned out, or that the exchange was trading with them, or whatever else. You'd also be forced to confront the fact that your assets are at risk at that point.