So in the StrongCoin case, I agree that once he decided to act, he should have helped the victim, as he did.
I don't think OP cares much about the moral issue at hand but the fact that it may need to be more publicly known that the wallet can highjack your funds if the operator desires. The common idea is that (probably incorrectly held, but held none the less) the public/private key cryptography protects you from them spending or doing something without your signature from the browser.
I think this is a big issue. If the admin can gain control over your coins, any attacker talented enough, be it in hacking or social engineering, can also access your coins.