I would assume that if someone has a certain amount of bitcoin in their kraken account, then kraken has the same amount of bitcoin backing that, and the same for everything else.
Customers deposits must be backed by cash, not assets. Because the second those assets lose value the deposits are no longer covered.
Any exchange that doesn’t publish their full balance sheet can be considered fraudulent at this point. Because it’s such an easy win for them if they do and everything’s kosher