Let suppose we have e-shop where you can buy with bitcoins. In this case, there is
bitcoind that have locked wallet. In fact this wallet is never unlocked, because you can have another wallet on different computer with same wallet.dat file.
So in case of e-shops, even website is hacked and the hacker have full access of the server, he / she will not be able to steal any coins.
However in case of coin exchanges, there must be automatic withdrawal process. I am sure some exchanges withdraw money manually, but exchanges like Bitstamp, Bittrex, Binance, CoinExchange.io and others have such high volumes and this definitely can not be done manually.
How these exchanges protects against hacks?
Because the wallets must be unlocked, so all hacker need to do is to type
bitcoin-cli send ....
If the wallet is locked, hacker might find the password somewhere on the server. Then he / she might unlock the wallet and send the coins.
Other way is hacker to "insert" his payment in payment queue and the system will send the coins for him.