Obviously they keep very secure wallets. They could even keep a decentralized version of the seed phrase with different, trusted individuals. So that every trustee has one word exactly and nobody knows who the trustees are except for a select few.
Dividing up a seed phrase that way is not secure. Each word of the seed that you leak
exponentially decreases security. An attacker who recovers a large enough proportion of shares, but not the whole thing, will be able to bruteforce the rest of the seed. Furthermore, there is no way to provide redundancy, or to specify M/N access policies.
A popular approach to try to solve that is Shamir’s Secret Sharing. In M/N Secret Sharing, an attacker who obtains M-1 shares has
no information about the seed. That has had some horribly buggy implementations, and it has been criticized generally by some experts (notably, Greg Maxwell). I do NOT recommend using it, unless you know exactly what you are doing; but I disagree with the general criticism. It needs better implementations, better standards (such as the Satoshi Labs protocol for this), and application to use cases where it makes sense—not ridiculous use cases, where it is too often misapplied. Reconstruction of the key is potentially a major problem for the use case stated in OP; therefore, it may not make sense at all here, depending on the circumstance. I note that there exists some enterprise software using SSS to secure the keys for corporate secrets; most Bitcoiners have no idea about that, and it is not a Bitcoin thing.
Multisignature, as I suggested in my prior post, accomplishes the same objective for the use case addressed in OP. With Taproot, a M/N multisig (and many other access control conditions)
can be made indistinguishable on-chain from ordinary spends; this obviates any blockchain privacy and distinguishability concerns, one of my own general objections to multisig.