All of their funds are kept in cold storage. When you make a deposit its sent to a 3BMEX.... address which is multi-sig. And the owner+essential workers there need to sign it manually everyday to process the withdraws. Hence even if some hacker did hack their site, they wouldn't be able to steal any of their funds.
Sure. But it's not that simple. Though it definitely makes it a lot harder for hackers to steal the funds, them having their funds in their cold storage doesn't make them immune to hacks. And that's just one of the potential issues. There are other things to take into account like potential account locks and government subpoenas.