I think I understand your question. Let me try to answer.
the online wallet operator stores only an encrypted version of your private keys
key decryption and transaction signing is done on the client side, without giving the operator access to your unencrypted keys at any time
you have a strong passphrase on your private keys
the client-side software is correctly implemented and not compromised
Then an attacker or dishonest employee who gains access to the operator's data will not be able to spend your coins.
They could conceivably delete the operator's copy of your encrypted keys. If you have a backup, this won't really bother you, since you can decrypt the keys and use them to spend the coins yourself. If you don't have a backup, then the coins may be permanently lost: neither you, the attacker, nor anyone else would ever be able to spend them.
They could also threaten to delete them, or demand ransom to return the encrypted keys to you. Again, if you have a backup, you can ignore their demands. If you don't, then they have you over a barrel, and you might be motivated to pay them a sizeable fraction of the value of your coins to get the encrypted keys back, because otherwise those coins would be lost to you.