They are only insured against employee theft, or someone stealing from them directly. If someone hacks into your account and withdraws your money then their insurance will not cover this.
If I understand correctly, the insurance only covers the amounts in their hot wallet, the funds in cold storage are not protected by insurance.
That should be sufficient if all their customers use two factor authentication.
There is no known method to decode two factor unless the person is negligence on their own smart phone (and storing password on them).