They guarantee the vendor a certain rate for a time window of 15 minutes or so. If the buyer makes a payment within this time frame and gets at least one confirmation (which is the buyer's gamble), BitPay pays the vendor immediately in USD (or other fiat). I guess they have USD reserves to make these payments and restock them by converting part of their Bitcoin holdings from time to time. If Bitcoin collapses completely, they blow up. Though even their risk is controlled because they can stop processing payments at any moment.