You are correct, they also give you IOUs (see mtgox debacle for the risks). But to minimize the risk, you can immediately withdraw the asset to your wallet after trading.