Unlike Money that can be transferred and withdrawn/spent, you can’t really do that with securities. So assuming CDSL gets hacked and say you have 100 shares of Reliance. What can the hacker do with the 100 shares? The only thing he can do is to move it to another Demat account with NSDL or CDSL.
The shares transferred can be sold and withdrawn to a bank account. But this takes atleast 3 days. The hack will most likely be spotted by then and accounts blocked.