I'm pretty sure custodians have stolen more cryptocurrency than whatever was lost by users doing self-custody incorrectly. and much of that theft was "legal"
Especially true if you include theft via taxation