Yes, owners of site definitely could, if they want to. In fact, you don't have sats here, you have IOU against sats. They become your sats only after you withdraw to non-custodial wallet where you control private keys.