I was always under the impression that sites like this didn't even store user funds.
Don't know why but, I was thinking they were just using the APIs of other exchanges to make the trades and skimming a small % off the top to make their profit.
There were a few of them in the past that operated that way. Put together a pretty interface, no real KYC, and just take a small cut.
Now that you mention it: I also thought that's how they operate, especially since they have a fixed or dynamic fee rate.
But withdrawal fees of most exchanges are a problem for that business model. Unless they get a custom deal, most exchanges charge far more to withdraw than an instant exchanger can earn from small trades.
It would make sense to only handle large transactions through a CEX, and handle small ones by themselves. That way they'd only need $26k instead of $26M in their hot wallet.