With more details emerging, it seems more likely that this isn't incompetence regarding cold storage but rather an exit scam: https://www.ccn.com/wheres-the-missing-150-million-crypto-exchange-quadrigacxs-fiasco-gets-weirder-with-new-research
Apparently there are no cold wallets, withdrawals were being paid from deposits, and the "inaccessible" wallets have continued to move funds after the alleged "death" of the owner. It seems like this owner has been regularly siphoning off funds for himself over the past several months and years, and was essentially running a Ponzi. Also worth pointing out that since Quadriga required KYC, he could quite easily have used any of the submitted KYC details to open accounts at other exchanges to cash out.
A great example of "not your keys, not your bitcoin" and avoiding KYC requirements all rolled in to one.