Good question. Funds from cannot be stolen, unless you know private key. ChipMixer knows the key, you as a customer knows it and nobody else. Let's assume there was a hacker who somehow got the private key too.

How he got it?

Method 1. Eavesdropping

Customer visited http website? No, it redirects to https and you cannot start mixing with http.
Customer visited https and it was eavesdropped? No, https is encrypted, so private key will also be encrypted.
Customer visited .onion website? It is encrypted, so private key is also encrypted.
Customer visited MITM or forged copycat of ChipMixer? Attacker serves his address and does not give you any chips. Why risk that you will sweep them immediately?

Method 2. Hacking the server

Destroying the session deletes chip private key. In this case attacker would sweep hot wallet and active sessions. If for some reason you do not want to sweep everything instantly, there is no reason to sweep single private key of active session. This would only hurt ChipMixer reputation and that decreases your change for large loot.

This shows that single private key cannot be evesdropped, and hacking the server would result with much bigger mess.

Another group - ChipMixer. Stealing single chip hurts reputation. It is not worth to be little dishonest, when you pay much more for ads and sig campaigns.

Last group - Customer. Let's say you sweeped 1.024 BTC chip. You can write a post that somebody else sweeped it and you demand a refund. If you don't get a refund, you've lost nothing. If you get a refund, you've earned 1.024 BTC and nothing stops you from posting more complaints. Which is why ChipMixer will not refund.