Yeah, it is secure until they decide to froze your account over something you probably didn't  know was against their Terms of Service.
Until you don't have copy of your wallet.dat on your local drive and your private key is encrypted on the server side of the service you are using (so no one beside you can access that),
you can't really say online wallet is truly  secure. Can you achieve that with Coinbase or Xapo?