Correct, besides due to the transparent nature of the Bitcoin blockchain it is possible to know how many Bitcoins each address holds.
An exchange could not claim or lie about having a sustantial quantity of Bitcoins because they would have no way to proof ownership of any address holding actual Bitcoins.
It is similar to what happens to Faketoshi, claiming to own some especific addresses but not being able to sign a message, if an exchange cannot sign a message from their alleged addresses, then they have no control over those coins, as simple as that.