The usual construction is a hash time-locked contract on each chain: either both parties can claim their side or both refund after a timeout. No custodian holds funds mid-trade, which removes the seizure-in-flight risk that instant exchangers carry.
The limits are liquidity and footprints. Finding counterparties takes coordination or a protocol that arranges it, and both legs are still written to their chains, where amount and timing correlation remain possible.