I don't know the size of the exchange, but it's reasonable that they would have enough bitcoins in the hot wallet to process withdrawals on an "unlucky" day - that is a day where significantly more people withdraw than deposit. That could easily be 150BTC for even a small exchange. (the article says 150 were stolen, not 194)

considering going up a level in security basically means hosting your own servers, it's probably worth the risk as long as you assume your hosting provider doesn't give strangers root access to your box