How can they protect merchants risk exposure from recent Bitcoin BTCUSD exchange rate extreme fluctuations?
I have no insight any better than anyone else not affiliated with BitPay, but the exchange rate used for determining the BTC amount on the invoice is only good for 15 minutes. BitPay absorbs the volatility during that 15 minutes, not the merchant.
In those 15 minutes of exchange rate volatility, when the rate moves in Bit-Pay's favor they do refund that to the customer (or did at one time, I can't remember if their new checkout does that). Their fees are substantive enough to accommodate the 15 minutes of risk to volatility.
They then likely are automatically trading either with every sale or in batches occurring not much thereafter. They likely have sufficient reserves at their exchange(s) so that when the coins arrive from the proceeds of the sale that a trade can occur immediately without any delay occurring from trying to first forward the coins to the exchange.
Because BitPay doesn't have merchants who trade high value liquid assets (e.g., financial instruments, like contracts for purchase of gold), then they really aren't at much risk of someone gaming Bit-Pay intending to place an order that locks in the exchange rate, followed by their trades that move the market, followed by making the payment just under the 15 minute expiration.
Also, BitPay sells coins in bulk (i.e., orders of $10K USD and up), so they may have buyers waiting where each incoming flow of coins to BitPay is already spoken for and occurs at either a negotiated rate or terms that link the rate to the invoiced rate thus removing any risk of volatility affecting BitPay whatsoever.
