If you don’t have the private keys to your bitcoin, you don’t control them. Exchanges can get hacked, go out of business, or refuse withdrawals. It's just an IOU from a third party.