My guess is as public companies, they have to follow particular standards and use specialized custody companies like
Coinbase Custody
I wondered the same thing while the whole thing was at the beginning, and I have to admit that there was no concrete answer as to who and in what way keeps their BTC. Given that Coinbase bought on their behalf, and they have a service that is just meant for such customers, it is very likely that BTC is right there.
I totally agree that it is not at all realistic for them to use any other way for what they bought through their companies, but it is possible that the story is quite different with what they bought privately - and it is known that Saylor bought a certain amount with his private money.
This is exactly the part I don't like in Bitcoin: why is everybody so curious about that happens inside this or that person's pocket?!
I may be wrong, but I think this is about people wondering if they really own what they bought, or if they are among those who don't understand what
"not your keys, not your coins" means. Seen from our perspective, they don't really own anything in that case - just a promise that something is somewhere.