I agree with both of you but perhaps, they had to keep a certain amount in their hot wallets so they could process fast/priority withdrawals [not taking sides].
- Unfortunately, they paid the price for offering such withdrawals [even though I'm sure they've gained a lot from those fees] and it'd be interesting to see if they'll be offering it again.
Yes, it's something understandable to keep some funds in the hot wallet. Like Freebitco.in for example, they keep just 5% of their Bitcoins in hot wallet.
While in this case, I suppose that biggest part of their crypto were in hot wallet. There is over $600k worth of crypto were stolen, I hardly can imagine that faucet microwallet would had much more crypto. Especially considering that they aren't as popular as Faucethub or Faucetbox were in past and there is not so many people using faucets like few years ago.
It will be interesting to follow how this story will developp further.