Can a clever hacker still steal everyone's money from the blockchain.info wallet?
They anticipated this type of attack and they are monitoring their JavaScript files, check this website of theirs http://blockchain-status.com/javascript_verifier

Also, CloudFlare (the reverse proxy they use) can modify the Javascript on the fly (CloudFlare is at the other end of the encryption for your browser, so SSL here only secures the connection between you and the CloudFlare machines, and optionally CloudFlare to Blockchain.info, you're not directly connecting to Blockchain)

It is true that the client-side script does not send the password to the server but you actually need to send your wallet password to use their old wallet API (it's being deprecated) and if a hacker can somehow control their servers, it is possible that the hackers can read the unencrypted wallet from the memory without having to inject malicious client scripts, even if we assume they are not saving them to the disk.