While hot wallets provide decent limits on hack damage, I think exchanges would be better served by also implementing smart-contract-level rate limits to protect against operator key compromise. The danger lies in allowing massive fund movements as part of regular operations. If there is a genuine large withdrawal, exchanges can put overrides and special checks in place. DeFi is a good example of where rate limits help to reduce the attack surface.