The exchange needs to have custody of the assets (tokens for a sell, money for a buy) before an order can be placed. That’s the only way they can guarantee that the order will execute as soon as it is matched, and that both parties will receive their assets, without the ability to back out.
So the correct order of your steps is:
3, 4, 1, 2, 5, 9, 6, 7, 8, 10.
Of course, variations are possible: 9 could happen earlier, for instance. The buy order could be placed before the sell. Or the buyer could wait to withdraw the token they bought.
This doesn’t account for the possibility of things like margin orders, where the exchange might allow someone to buy using money that’s borrowed instead of deposited.