Now when I have moved my bitcoin from my bitcoin wallet to vault and checked the transaction in the blockchain.info, I was kind of surprised that from address was different from original deposit address a1.
Also, looking into blockchain.info, I was surprised to find that my deposit address a1 was used to send bitcoin to other addresses as well which I have never initiated. So, it looks like XAPO has provided the same deposit address a1 to other users as well, which is not good.
Instead of thinking as the addresses being "my addresses", think of them as Xapo's or the exchange's addresses. You are not depositing into your wallet, you are depositing into Xapo's or the exchange's wallet and the addresses they give you belong to their wallet. When they receive your transaction, they just update an internal database for your account's address. The money that you deposited becomes the service's money and they promise to give you back the same amount when you ask for it. This is similar to how banks work
In that case, I have to be dependent on their internal ledger to claim my funds, no?
Yes. This is the same for basically all exchanges and all online wallet services (with a few exceptions). They are custodial, you give them money and they promise to give you back the same amount when you ask for it. In the meantime, they can do whatever they want with the coins. This model is generally easier to implement and less costly as the service can move around coins to reduce cost later.
Furthermore, instead of then having to keep everyone's coins in hot wallets (wallets that are connected to the internet), they can move most coins to cold wallets (wallets that are not connected to the internet) and keep some in hot wallets for people who wish to withdraw. Actually assigning and "spending from" addresses for each user results in perpetual hot wallets which is not secure.
Will the withdrawal process be same as well, meaning when I withdraw from Vault to wallet, the from address will be different from what I see now as my vault address, b1? And when I finally move my fund out from wallet to let's say Bittrex, that txn will also show a different from address?
Yes. The transaction will "send from" addresses that belong to other people as is convenient for the service.
In addition to that, if XAPO regularly moves the fund around, won't it cost them a lot of fees?
Xapo probably isn't actually move the coins around internally, but rather the coins that you deposited went into their hot wallet and someone requested a withdrawal so those same coins were sent to that person.
