1.) Wavecrest assumes absolutely no exchange rate risk as they don't deal with the BTC, a company like Xapo does
2.) Xapo make a very big margin on the bitcoin sale
3.) The companies that perform the sale at topup time rather than purchase time work out how many GBPs you get after they've sold your BTC, so they assume no risk at all, and the companies like Xapo that perform the sale at purchase time structure their operations to minimise the risk of losing money, and they're aware of the risk, and they're far from the first company in the history of the world whose operations require them to adequately manage risk.
This is identical to Paypal, or any other payment rail in the industry. Payment companies don't in general make loans to their customers (though anything is negotiable in principle).
Source: have integrated with Wavecrest.
The details are very dependent on commercial negotiations (i.e. how much volume the payor is bringing, etc).
On what planet? If the price fluctuates the way bitcoin has been, Wavecrest could literally be bankrupt before Visa even knew about it to pause any further transactions. At which point VISA is responsible, you think they're going to risk billions of dollars on a currency that is clearly a bubble at this point?