There has to be some that don't I'm sure, but I think most do self custody.

My reasoning is most major CEXes don't offer Monero or have already delisted it. And the Monero community has a strong P2P, privacy conscious(using custodially degrades privacy), and no-KYC culture.