Online wallets are unsafe because the your private key will be shared by the wallet provider.
In the case of Coinbase and Xapo, yes.
Blockchain.info, Green Address and BitGo are not in a position of enough power to steal your coins, provided that you use the features that they let you use. I'm sure that there are some others as well. In blockchain.info's case, you have access to your private keys.
Blockchain.info is not safe either. The "feature" to access your private keys is no guarantee you are the only one who has access to this key.
I would always recommend a desktop wallet. At least a mobile wallet.
This is also the best way to ensure you are getting your new coins after the fork. Just make sure to have a backup of your private keys and dont let someone spy on you.