Interesting research. I'm going to go back and read their User Agreement and other policies. But private keys are usually the way to go for safety. Coinbase is convenient, but not nearly as secure for your funds.

Here's the link to Coinbase's User Agreement and other policies:
https://www.coinbase.com/legal/user_agreement?locale=fr