You should completely forget about the notion of a Bitcoin being "located" online or on a particular computer. It isn't a good metaphor for the way the currency actually works.
There are addresses, each one with an associated private key. Each address has an associated balance; if the balance is greater than 0, then some bitcoins "belong" to that address. The blockchain or transaction register, which contains information about the balances of all addresses, is stored "online" by all nodes on the Bitcoin network. This is maybe what you are thinking of when you say "Bitcoin is somewhere online".
However, to actually spend coins, you have to have the private key, with which you can create a transaction sending some coins from the address to some other address. The private key is an actual piece of data that can be stored on a particular computer (or a phone, or a piece of paper, etc). It is normally held only by the owner of the coins, and not by anyone else.
When a customer buys coins on an exchange, initially the coins are held by the exchange itself, which means that they belong to an address whose private key is held only by the exchange. They just update their internal books to indicate that this customer is now entitled to withdraw those coins (see below). The customer doesn't have a copy of that private key. If the exchange is hacked at this point and its private keys are accessed, the attacker can transfer the coins to his own address. After that happens, the exchange's private keys become useless and can no longer control what happens to the coins, but the attacker can spend them as he pleases. The coins have effectively been stolen by the attacker. Neither the exchange nor the customer can get them back. The exchange might reimburse the customer, but that is strictly between the exchange and the customer, and the Bitcoin protocol itself cannot force this to happen.
The customer can also withdraw the coins, by instructing the exchange to transfer them to a new address, of which the customer (and only the customer) holds the private key. After this is done, the customer is the only one who controls those coins; the exchange's private key is now useless. If the exchange is hacked at this point, nothing happens to those coins. However, if the customer is hacked (or accidentally erases her private key, etc), then she loses the coins. The exchange cannot do anything to help recover them, since it never had a copy of the customer's private key. (In the case of hacking, the private key wouldn't help anyway.)