It happens when the cold storage is warm. If the cold wallet passphrase or the private keys were not printed on paper and were accessible to a networked computer in any fashion then it would not be considered as a cold wallet to me.
I suppose that could be. It's not really a cold wallet if scripts from networked machines automatically pay "hotter" wallets when they run low.