Who can move the coins

ethereum.org says a centralised exchange links the account to a username and a password that can be recovered in the ordinary way. The exchange has custody of the funds. If the exchange is in financial trouble, the funds are at risk.

The same page says a wallet provider does not have custody. The wallet is a window onto the account, and the provider can be swapped.

If a firm stops, the Financial Services Compensation Scheme does not protect you when the firm goes out of business, so you are unlikely to get the money back. A complaint generally cannot go to the Financial Ombudsman Service. Being on the register does not create that protection.

ethereum.org says an account is a pair of keys. The private key stays secret, because it is what signs. A wallet is the tool that uses the keys.

Wallets often give a seed phrase. ethereum.org says to write it down somewhere safe. It says that phrase is the only way to recover the wallet, and not to store it on a computer. It says there is no customer support in crypto, and that the holder is responsible for the keys.

The keys page, from NIST IR 8202, says there is no forgot-my-password button. If the private key is lost, what it controls is lost, because the same key cannot be made again.