cex.io doesn't even have to mine. Right now, the price of 1 GH/s is about 0.044 BTC, but 1 GH/s will probably mine less than a total of 0.02 BTC due the rising difficulty. When they sell GH/s for 0.044 BTC, all they have to do is reserve 0.02 BTC for mining payments, and they can keep the rest for themselves.
But they must predict very well the difficulty increases in next half year, or it will not work. Like if the difficulty stop rising, they will have to pay more Bitcoins than customers sent them
You are right that they have to predict the difficulty, but they don't have to predict very well because cex.io miners predict so badly. Since cex.io started, the cex.io buyers have been buying at a price that predicts a rise in the difficulty of 10% - 15% each period, when the actual values have been 20% - 45%.
You would expect cex.io buyers to be good at predicting the difficulty because their profits depend on it. But they aren't. They suck.