Also: they mostly buy OTC from what I can tell, and of course there’s risk that Coinbase (as the custodian) doesn’t actually hold the coins.

It’s simple. They don’t buy real Bitcoin, just promises.