The figure on the exchange is impossible to know for, obviously, many people hold coins there with the purpose of selling the at some point but not necessarily listed for sale right now. As a matter of fact, less than 200k are listed for sale at all kind of prices. The figure in the Maximum network weight can be misleading for several logical -and others than I don't understand- reasons. For instance, although all my coins, are mature, my network weight is roughly 15% below the coins I actually have "staking". I would imagine that the maximum network weight of 0.5 mill would also be off at least by 15%, probably more. One of the reasons that I understand is that the mined coins -and it is a significant number- are not mature until 4 hours after being mined; other reason would be the coins in movement towards the exchange and from the exchange. In any event the maximum network weight oscillates between low 400k and low 700k during the day, which is a big oscillation and the reasons for it could be a combination of all of the above. I don't suppose -but it is always possible- people will already have significant amounts in cold storage, not staking, but whatever some people has, it would also contribute to the difference.
It's like this with all POS coins. A large part of it is because not everyone has a PC where they can reliably stake 24/7. Some people only stake for part of the day. The other reasons are as you said. Coins moving around, blocks maturing, coins not eligible for stake. That is one of the features of POS 2.0 that I love. The removal of coin age from the equation means that people who consistently and regularly stake 24/7 day in, day out can gain a significant advantage over those who don't. It can accrue into a large increase in your share of the total % of coins over time, and that is a far more important figure than your absolute number of coins.
No one has these coins in cold storage. Anyone who has the technical knowledge to properly put the coins into true cold storage (meaning storage at an address that was created on an offline computer with a clean OS where there is no possible vector for the private key to have been comprised) is not going to be dumb enough to put them into cold storage when it is a POS coin and so much of the total coin supply has yet to be mined. Plus, I am still 99% convinced this coin is a scam and I don't think even believers are confident enough in it to bother putting coins into cold storage yet.