Why would they need the actual coins to allow trading? Only transferring would require access to a wallet.
So like, you buy not from someone selling, but from Coinbase's stash, who then buys to refill from someone else.
No idea how accurate that is though, maybe someone can back me up or correct me here