That's exactly the scenario they say they would never do and go as far as to have external audits to prove that they're not just "printing" free cash
The alternative is the stablecoin providers effectively keep the money for themselves. At that point the justification for the blacklisting seems like little more than self enrichment?
Have bad security, get hacked.
If binance wanted to hedge against that risk, they could have bought a cyberinsurance policy (if they could get one for the amounts they'd need).