Most likely some sort of cold wallet. With some in hot wallets for liquidity. There are many crypto custodians who do this.
Now they do have to design redundancies for the keys. eg. they should not lose access to the assets because say they made it too safe and cant find the keys anymore :p
It's funny because it happened with Prime Trust a crypto custodian. But I'm sure a company like BlackRock can and will do better.
I have no idea, but I assume that if they get hacked they are liable for that. If the ETF is run by Bob's Bitcoin ETF incorporated in the Virgin Islands then that's not worth anything because there are no other assets to cover losses. But if it's BlackRock (or some other large US money manager) then they have plenty of other assets to pay out.