It's not really comparable to Pwn2Own. Pwn2Own's only vector of attack is by finding flaws in the software directly.
All of these wallet service companies employ people and many, many successful hacks are performed by exploiting the people involved / mistakes the people make.
So while software with enough hardening can eventually get to a state that's quite safe, as long as people are an active part of the security chain, you're going to have valid attack vectors.
There have also been attacks on Bitcoin companies that exploited their hosting company's procedures or lax handling by their employees. Securing this stuff is fundamentally hard.
All of these wallet service companies employ people and many, many successful hacks are performed by exploiting the people involved / mistakes the people make.
So while software with enough hardening can eventually get to a state that's quite safe, as long as people are an active part of the security chain, you're going to have valid attack vectors.