It already happened and is happening. Bithumb, at one point being one of the biggest exchanges, did EXACTLY what's described here. I haven't been keeping track but they only allow you to move your bitcoin only when they want you to (or simply will not process your order). Most exchanges in my country operate in a similar way. I experienced this personally when I tried to move bitcoin out of "my wallet" and the exchange denied it "for my own safety". Ofc you only have an "account" somewhere on their server with no access to any key whatsoever. Not your keys, not your crypto indeed.