Hardware wallets like the Ledger Nano are good cold storage solutions.
Offline-wallet creation in an air-gap device is also a good solution.
Kukai wallet offers you the possibility to do offline-signing so your seed is never exposed to the online world when interacting with the network.
There is no need to keep the TZ account "hot" (as in online) while delegating. LPOS allows you to select a delegate and then keep your keys in "cold storage" (as in offline).
The baker however - Coinbase in this case - needs to constantly sign blocks and endorsements and hence needs to keep the keys to their own funds available for signing.