They could just as well hedge the "PayPal-Bitcoin" they hand out to their customers with unbacked Bitcoin futures. They don't necessarily have to buy the underlying as long as they can find some other party who's willing to engage in a bet about the future of the Bitcoin price.
Though I must admit that it's doubtful for them to find enough cash to take the other side of this bet, so most likely they have to resort to actual Bitcoin bought from liquid exchanges or OTC.
Bitcoin futures are running at about 25% per annum carry.
They absolutely can find counterparties to take that trade, but it would be much more efficient to trade in the spot markets.
The real question is if they have custody operations setup to handle the coin.
I expect they outsource these backend operations to the likes of Coinbase, Gemini, or Fidelity.
They probably won't allow customers to transfer their Bitcoin out until they move custody in house, which is no easy task.
Though I must admit that it's doubtful for them to find enough cash to take the other side of this bet, so most likely they have to resort to actual Bitcoin bought from liquid exchanges or OTC.