I don't think OP cares much about the moral issue at hand but the fact that it may need to be more publicly known that the wallet can highjack your funds if the operator desires. The common idea is that (probably incorrectly held, but held none the less) the public/private key cryptography protects you from them spending or doing something without your signature from the browser.