Since Coinbase has a large cold storage reserve, and since multisig-protected coins can't be put into cold storage, the answer is pretty clear: Coinbase protects few people.
It's a false dichotomy that coins must be stored in a personal wallet that users mess up, or a webwallet that exchanges mess up. There's a third option: Convert those coins back into USD and stick it in a bank. As long as you're storing less than $500,000, you're guaranteed to have it.
Anything else is pure greed. As someone who has been burned by greed, my misfortune stands as a warning to others: please don't make my mistakes.
The reason I lost coins is because I was tempted by Mt. Gox. Their 2FA auth made it seem very unlikely that my coins could go anywhere, just like Coinbase. If I'd researched Mt. Gox, I would have discovered a history of technical problems. Yet if you research Coinbase right now, you'll discover they've had a history of those too. There have been at least two or three high-profile Coinbase incidents over the years which were featured on HN. And if you research Bitstamp, you'll see they just lost $5 million.
The common denominator is that exchanges and webwallets aren't trustworthy.
No it doesn't. History proves the polar opposite; MtGox alone ate more coins (>750k) than all known incidents of wallet theft together.
Best practice is to use your own wallet. Has always been this way, will likely stay this way for a long time to come.
Further, Coinbase does give users access to their private keys with the multisig vault, so one of your two criteria has already been met.