Lightning involves an always-on, networked, machine holding your private key. Your bitcoin is a bounty for 0-day exploits. Brilliant!
By design, the Lightning hot wallet can only hold small amounts of BTC (0.042 BTC currently), and yes, this would be essentially a hot wallet. The funds are held in a trustless, multi-sig, timelocked payment channel between you and your channel peer (which does not have to be the intended recipient). A channel can stay open indefinitely, and it will be possible to replenish it as needed. The idea is to have it function like a checking account. I fail to see how this is any different from a regular BTC wallet on your phone, or even your bank/investment app (except safer).If you're really paranoid about the funds in your hot wallet, you're free to create an m-of-n multi-sig wallet with somebody else you'd trust, which renders that attack vector useless.
Also, your LN wallet needs to remain online _only_ when it needs to transact. It can go offline the rest of the time with no problem. When it needs to make a LN transaction, it'll need to remain online for the duration of the transaction (a few seconds), or else the fund recovery mechanisms will kick into place.