I suspect the problem with Coinbase allowing people to withdraw Ethereum Classic is that they've already been drained via "replay attacks". If so, in my opinion, the fault lies not with Coinbase, but with Ethereum devs who didn't bother to prevent replay attacks, despite knowing about them prior to the hardfork.