It depends on how the institution understands the safest means for them to keep their bitcoin . Some institutions might believe that exchange is the best place for them to keep their bitcoin safe, because they don't want to put the burden and blame if anything happens to their investment, they have who will be held responsible because they don't want to take the risk of keepin their bitcoin themselves. On the other hand, institutions that understands that it is only them that can keep their bitcoin safe, will use a hardware wallet so that they can be in full control of the safety of their coins. Such institution will go at any length to make sure that their funds is safe since they already understand that they are the one that will be responsible for any hack.