You should download from them your "private keys" if you want a backup (just make sure you don't have a virus, etc, so they arent stolen)
There is an option to export my private key, (encrypted or not).
Technically, I can save it somewhere secure and that should protect my coins.
Having said that, if blockchain has my private key, (I suspect they have to have it in order to give to me in the first place), they also have my password, (yes, they can claim that it is encrypted and so forth).
So with those two values they could take coins out of the wallet, could they not?
Is that not right or am I still missing something?
FFMG