Yes, it's true that a user can create a limit order without depositing funds. At a technical level, a user signs the transaction, allowing the KyberSwap smart contract to swap the token on users’ behalf, at the specified rate and quantity. With the signed data, once limit order conditions are met, KyberSwap will broadcast the transaction to the ethereum network.

KyberSwap smart contract is fully audited by multiple entities and it is available on GitHub.