If they are not operating on fractional reserve or doing anything shady then this is no big deal and how the system is supposed to work. A smaller run than this took down FTX.
They take a cut of trades. No one external actually knows if they are using deposits for other purposes
They sell coin listing access and coin drop promo access and can sell on insider information. I imagine deals for certain coin access are paid for in that currency
Over the last year we've discovered that there is no safe way to do this. Every company that lent out customer crypto deposits is now bankrupt. Unlike "tradfi" where you can lend to a stable government or a diverse basket of companies engaged in the real economy, crypto has no risk-free rate of return.