They could sell their own BTC, or buy with their own fiat, but in case of peer 2 peer exchange - yes, they do have to hold on customers' behalf.