[Edited a few times per comments]
Bounce rate and exit rate aren't comparable values. For Page A, the bounce rate is
(sessions where the only hit was a Page A PV) / (sessions that landed on Page A)
whereas exit rate is
(Page A PV that were the last PV of their session) / (all Page A PV)
See Exit Rate vs. Bounce Rate from Analytics Help.
Since your bounce rate is defined, your cart and checkout pages are getting some landing hits, but if there are not many landings on those pages, the bounce rate isn't particularly meaningful - it could be changed a lot by just a few sessions.
Question 1: why are pageviews are getting counted as landings when these shouldn't be landing pages? Is there really earlier activity that should make these "bounces" exits but is getting disconnected?
First I would check how many landings GA is recording to these pages. In Behavior > Site Content > Landing Pages, how many sessions are recorded? If it is a small number it could be spam or what I think of as "zombie hits" (we still get a small number of event hits for events we disabled four years ago). In that case I would make sure you have reasonable GA spam/bot protection activated but otherwise not worry about it (personally).
If the number of landings is significant, I would still make sure the spam protection is set up well, but also look for links that trigger new sessions. Has someone created internal links with UTM parameters? I don't know what ability you have to search through your content, but if you filter to the pages you're concerned about in the Landing Pages report and add Source / Medium as a secondary dimension you'll get potential parameter values.
Finally, does your GA filter out internal traffic? If our onsite traffic were not filtered out, I would add many landings and bounces to our data.
Question 2: Why is the exit rate so low?
15% is not inherently unreasonably low, but you may have reason to believe it is (such as industry averages, per the comments). In that case, see what other sources of data you have to cross-check GA: server-side analytics or logs and transaction data from inventory or financial records. Do the numbers agree? If GA is recording basically all of the transactions (it will never capture everything), then the only way the exit rate could be wrong would be by missing out on earlier pageviews, and doing so in a way that disproportionately misses pageviews that didn't lead to a conversion. That seems unlikely; it seems you'd have to be sending pageviews in a very nonstandard way to have that happen.
Whether the exit rate is right or wrong you can find more information in GA about where people are going. I would suggest setting up your checkout as a Destination Goal with an associated funnel going all the way back to the cart. Conversions > Goals > Funnel Visualization is a magical report that gives you information about where people came from when they enter the funnel and where they leave to if they jump out of the flow - for information like this, which is more about general site use than shopping, I think it is more helpful than the Conversions > Ecommerce reports. You will get the most information from it if you do not mark the first step of the funnel as required.
That won't be retroactively applied. With your existing data and for a specific page, for instance the final page of your checkout, you can use the dimension Previous Page Path. In the Behavior > Site Content > All Pages report, add that as a secondary dimension, and then in the advanced filtration area, include only Previous Page Paths of the page you are interested in (for example, "Include Previous Page Path Exactly matching /confirmation"). The first column of the report will give you the pages that people visited after the page you set.
Unfortunately it is difficult in GA to get at before and after relationships, in general. There are sequence segments, but I don't see a good way to use them to answer this particular "why" question. Hopefully seeing the "where" will help with the "why".
However, exit rate ought to only be affected by pageviews, not other kinds of hits (per the definition, and experience reported in comments on the answer to this SO question Do Events Affect Exit Rate), so if it is inaccurate, the first thing I would look for outside GA would be virtual pageviews. Is there a modal or a drop-down panel that triggers commonly and is tracked as a pageview? Is it a single-page-application type checkout where additional pageviews are triggered when you scroll down? Confirming those are only firing when they ought to, or not firing at all if they are causing problematic data, would rule out one possible culprit.
