I don’t get when you say “they can generate a new private key”. If they move the funds to the new address you can simply track it (prof of reserve topic)
Anyway I was listening to Alex B. on the “all in bitcoin” podcast. I think he was rightly saying how we sometimes underestimate the concept of reputation (he was talking about in cashu banks topic). Sure they can fuck you over and run with your money, but they’ll lose trust forever and all future profit (they are actually inventivized to not fuck you over). In time will emerge the Trusted ones.
For sure we can never have 100% trust and sleep like a baby, but it surely will get better as the incentives will change and companies will be incentived to act in more trustful manner (on top of the fact that it’s getting easier and easier to move around and choose a different company)