Correct, nowhere, seriously NO WHERE, in any technical literature about POS does it say, "OK, now, a really big and greedy exchange should keep lots and lots of these coins in a hot wallet and have an SQL injection vulnerability coded into their site"
something happened with my last post so I will post it again here...
that's true but what if mintpal were staking? or some other exchange decides to get greedy and use their hot wallets to stake its PoS coins.
they claim they weren't but now that the idea is out there whats to stop someone from trying it...

some people say that staking that many coins chews up cpu.. but what the cost of running another server for your hot wallet when compared to the temptation of all those free coins?
For the exchanges that have to record everything you have to account for every transaction. Creating all those micro transactions have to be followed by a paper trail by lawyers and auditors. Most exchanges of size, and in certain jurisdictions will have to obey by those laws.