An exchange or other site holding coins on your behalf can do several things after a chain fork leading up to a new coin token;
- Add support for the new coin (Bitcoin Cash, in this case) and add it to your portfolio. This is the most "right" thing to do, but it may require quite some development resources. It's particularly understandable that sites that have always been bitcoin-only-sites can't turn around easily and add support for more token types. Development costs not only in development time, but also the added risk of bugs and security glitches.
- Credit you with the "free money" in some other way, i.e. sell all the accrued Bitcoin Cash and credit the customers with Bitcoins. This may also be non-trivial if the site has a highly secure cold-storage vault.
- Simply ignore the problem. This seems to be the approach i.e. of Localbitcoins.
- Procrastinate the problem, telling their customers that they will "eventually" get their Bitcoin Cash.
- Sell all the Bitcoin Cash and keep the money.
I'd say, only the last one would be equivalent with theft - but there is no reason to assume the last option as default. It should also be possible to figure out by studying the deposit addresses; if any deposit address had Bitcoin at the 1st of August and still has Bitcoin Cash but not Bitcoin, then it hasn't been pocketed (yet). If both the Bitcoin Cash and Bitcoin is gone, and the site hasn't made any public statement on Bitcoin Cash, then the Bitcoin Cash has most likely been stolen.