Most exchanges take a huge chunk of their btc offline in paper wallets. Hence it wouldn't be pretty if they have to generate like one address for each person and take it offline at once. Plus using a new address for each transaction enables the exchange to determine exactly how many bitcoins are deposited per transaction.
Not sure about the paper wallet thing, but I do believe some exchange do assign a receiving address per account, not per transaction. The fund does got transferred elsewhere later.Receiving fund doesn't require wallet file to be online, sending fund does, but as long as the withdrawal process is automated, it means the money has to come from some online wallet. If you can secure one address, you probably can secure many.
