Correct. A cold storage scheme might be private keys printed on paper and stored in a safety deposit box, for example. Then, if their network is compromised, they won't lose everything.

Not sure how much exchanges normally keep in their "hot wallets", but I've heard numbers from 10%-30%. If an exchange is hacked and decides to close and go under, they can also use cold storage to send some percentage of user's balances back to them.