Obviously you want to look trustworthy in the beginning to attract more customers, then... (?) ... profit?
I'm interested if there were historic cases of this kind of theft in Bitcoin's short history.
If I understand Instawallet correctly they can't access your wallet because they would simply have to go through so many of even the used URL's on their domain to find some balance between the too many itty-bitty-tiny balances, right? (Behind their SSL they see wht URL you go to, only the wide Internet doesn't see it, right?)
Edit: I don't want to ask so much, that's why I asked two related questions in one.