However, I would assume it is poor practice for an exchanger to have a customer's private key. Please correct me if I am wrong.
It's generally not a very good idea, but a lot of exchanges do this.
Let's say that a customer has Bitcoins, and wants to trade them to the exchange for dollars. If the private key is held by the exchange, this order can complete instantly - it just changes two rows in the exchange's database. However, if the customer holds the private key, they need to transfer the Bitcoins to the exchange. Getting the first confirmation for that transaction could easily take an hour.
Of course, if you aren't going to make any trades in the next hour or so, you could withdraw your money into your wallet. The problem is that not many people bother doing this.
Some exchanges, like ShapeShift, hold customer funds for the minimum possible period of time. However, they take a risk, because when they lock in a price for the customer, they don't know for certain that the trade will complete. They might buy some cryptocurrency in anticipation of selling it to a customer, but then have to sell it at a lower price when the trade falls through.
If you want to get around these limitations, you need a way to move money to and from the exchange faster. (Both Sidechain Elements and the Lightning network come to mind, but I'm not aware of anyone using either in production at the moment.)
