That should really be covered by them with the losses they've made through the hack. But, for how long they'll be able to? What if there's another version of this hack and they were targeted again by these hackers? I don't think that they'll be able to afford to cover the expenses and refunds of their users although they should still do it.
If I recall correctly, in the early years of some South Korea exchanges, they are not mandated to have funds at their arsenals or at least covered what have been lost in a instance of hacked. But the South Korean regulators implemented a very strict rule moving forward to have funds bye their exchanges so that they can cover everything.
It doesn't need a government ruling just for any exchange to cover what potential loss they can make. But that's a good step there and after that, exchanges have followed the same ruling for their own implementation to give more security and assurance for their users if something bad happens.
So this is what really happened here, Bitget have their reserves for this hack. Although again, it's a huge amount of money that they might have to keep if they only spend more money in protecting their infrastructure and somewhat stop this hack.
There can be less damage for the hack but each of these exchanges should anticipate that they're always targeted and this incident is likely to happen at any given time. So, being prepared for the reserves is mostly for this instance.