Who can move the asset?
That is the first security question. An exchange balance, a custodial wallet and a hardware device fail in different ways.
Self-custody removes venue counterparty risk and introduces backup, phishing and device-compromise risk. Neither model is universally safer.