How are popular bitcoin wallets implemented? How are popular online bitcoin wallets, like blockchaininfo's implemented? Why aren't they open-source?
Accuracy not guaranteed

Blockchain.info


Wallets are json files. The json file is encrypted using AES (crypto-js) before the browsers asks that it be stored on the server.
The wallet file is embedded in the login page as a html data attribute, the browser decrypts the file with the provided password and extracts a list of private keys and addresses.
The browser then asks blockchain info the balance and list of recent transactions for the decrypted addresses.
Upon sending the browsers asks blockchain.info for a list of unspent outputs. Then selects the outputs constructs and signs the transaction itself (bitcoin-js). When ready the transaction is serialised and sent to bloackchain for broadcasting to the bitcoin network.
Authentication is done using a unique "Shared Key" contained within the wallet file rather than the users password.
Server side we use 4 servers running MySQL cluster and java. A modified bitcoind client is used to populate the database.


See How It Works

Strongcoin


Similar to blockchain.info with client side encryption.
Private keys are stored individually on the server as a database entry rather than in a single wallet file. 
Authentication is done server side using traditional Sessions.  
Transaction construction and signing is all done in javascript.
Uses blockchain.info or blockexplorer.com to query balances of addresses. Uses blockchain.info to broadcast transactions.
Server side uses Ruby on Rails and Heroku 


Coinbase


Server side uses Ruby on Rails and Heroku
Custom MongoDB database to query balance of addresses.
Server selects outputs, constructs and broadcasts transactions.
Authentication is done server side using traditional Sessions.  
The web app directly connects to the bitcoin network using Bitcoin-Ruby to populate the database.


What are they not open source?

They are commercial enterprises with a large amount of development time invested. The code being open source would a) increase competition b) cause identical phishing sites to popup c) clones maybe be hacked or run by scammers damaging the reputation of the main site.

Parts of blockchain.info are open source. I personally hope the rest of the site will be fully open sourced one day but there is much to plan. If the code is just dumped it will not benefit anyone.