The Website Owner is Malicious
The website database is leaked
Assuming the site has been programmed correctly in the event of a database leak only your encrypted keys will be leaked. The attacker maybe able to brute force your password if it is not secure enough, but as long as users are made aware of the leak they will have enough time to move their coins to new addresses.
The website server is compromised
You forget your password
As your password is never sent to the server the site owner cannot offer a password recovery procedure. In the event of a lost password your key(s) will be unusable. Paper wallet backups can help with this.
Key logger or virus
If you have a key logger or virus on your computer it is possible to that it could intercept your password which the attacker can then use to login to your wallet and spend your coins. Traditional desktop wallets are also vulnerable to this. My Wallet is less vulnerable to this as the site supports yubikey two factor authentication.
One final note: Using My Wallet you can add your Bitcoin address only without the associated private key. If you then keep a paper wallet backup of your private key even in the event your account is compromised there is nothing to steal.