This is wrong: "your funds are held in a smart contract” when in fact only the collateral you originally deposited is. You can’t hold Monero or Bitcoin in an Ethereum smart contract so shapeshift, presumably, will hold those coins for you."
Shapeshift actually deposits an equal amount of ETH into the smartcontract that only you can close (hence why it is fully collaterized). And that's also the reason that the prism automatically cashes out if profits reach 100%. You don't have to trust shapeshift to hold anything since they provide the collateral for any potential gains up front (up to a limit of 100% gains - but they are even planning to add an option to add more collateral later).
I agree that shapeshift hasn't been very clear with some of their communications and marketing, and you brought up a lot of good questions regarding audits etc, but at least on the collateral front, I consider them in the clear.