How do they do that? I would do it like this:
Generate a pool of cold wallets and store the private keys on a offline computer. Then generate all addresses and move them savely (via usb)
to the main backend. When a user now creates a deposit address it is one from the cold wallet generated addresses.
Is that correct?
You would need to ask them to know for sure, but that's one way to do it. They could also use HD wallets for that purpose.
What is a semi-cold wallet?
PR speak for a hot wallet that the operators think is fairly secure

.