If you subscribe to the Bitcoin in-universe dogma that views committing fraud and extortion as something that central banks and governments do, not what free market actors entering into voluntary contractual agreements with one another (which are regulated by math and logic spelled out in open source code) do, then maintaining good opsec is not just good business but a moral imperative.

Lets say you never maintain much in the exchange, and always tumble coins before moving them in/out.

It would certainly be possible to prove identity when transferring BTC in/out of an exchange, but make it exceedingly hard to prove that they ultimately make it to/from wallets you control.

But of course possible does not mean it is likely.