I believe SHAKEN/STIR was mandated only for calls originating from within the US, however, most of these fraud calls are originating over VOIP (or SIP) from outside the US.
Coinbase is a publicly listed company, with all its assets & liabilities shared in quarterly investor updates. They store all customers assets 1:1 (ie does not re-hypothecate any of customer assets)