The only way for anyone to notice that they don't have enough coins to have every user/customer withdraw, is to have everyone withdraw at the same time, which won't ever happen so they are safe basically for ever.
Even back in December, when Coinbase's cold storage addresses were being emptied and all the funds moved around (to new cold storage, as it turns out), all the FUD and panic posts on here and reddit were about this being a whale moving their coins to an exchange in preparation to dump them, even though that was provably not the case. I didn't see a single post raising the possibility of "could this mean Coinbase has been hacked?". So even when their cold storage of 600k empties, people don't even think about them being hacked. No one is going to notice if they lost a few hundred or even a few thousand BTC in a small hack, and as you say, they definitely wouldn't advertise it.
Although maybe if there was a small public hack, it might wake some people up enough for them to actually withdraw their coins and store them securely, instead of trusting a random third party.
