An online wallet service could "lose" my bitcoins? At bitcoin.org, there's a prominent notice that an online wallet service could "lose your bitcoins."  As I understand it, all bitcoin transactions, and therefore wallet balances, are stored in the block chain, on the peer-to-peer network, so they would not be lost in the event of a service failure.  I suppose that the notice is meant to warn against loss of bitcoin addresses/keys, right?  As long as I back up my keys locally, I can always recover my bitcoins, right?  (Nevermind the case of an untrustworthy wallet service that doesn't protect my keys, or uses them to rob from me.)
The loss refers to a few things, all centered around the simple fact that using an online wallet creates a SPOF (single point of failure).

Consider effects on your balance when:


Online wallet operator incompetence enables


Accidental deletion of private keys for addresses in which your balance is stored.
Security vulnerabilities in proprietary code may let someone else send your balance elsewhere or store your keys for theft if and only if your balance gets large.

Online wallet operator dishonesty enables


Operator or its government(s) to seize your balance.
Vendor lock-in if you cannot derive the private keys yourself (e.g. your password simply decrypts client-side private keys stored on the wallet service).
Theft if the Operator decides to close shop, be it a MAD scenario or theft of balance once private key is exposed.



One should only use an online wallet with these features:


Service cannot derive private keys

Private keys are stored encrypted
Keys are decrypted client-side
User is prompted to accept code updates
User is permitted to review client-side code before accepting updates

Service offers portability

Once decrypted, private keys can be shown to the user
User tests import to another wallet client, be it a service or fat client

Service offers two-factor authentication

Password and security token authentication
Security token is decentralized or wholly random (RSA, Google Authenticator, etc.)
Security token is hardware-based and single purpose (YubiKey)