Real hackers (in the classical sense) are only a small part of the problem of online wallets.
It all starts with the fact that when you use an online wallet, you're usually not the only one in controll of your private keys (sometimes you don't even have access to the private keys at all).
You depend completely on the exchange or online wallet to handle all your needs (generating new private keys => public keys => addresses; safely storing those keys; managing your contacts; managing unspent outputs; generating and signing transactions; broadcasting; signing messages;...).

If the online wallet goes bancrupt => best case scenario you're able to restore your wallet somewhere else, worst case scenario you lose everything

If the online wallet doesn't support a certain feature => you're out of luck

If the online wallet has a bug => you'll have to wait untill they fix it

If you have a problem => the online wallet's support team will be the only ones that can help you, so you'll have to wait

If the online wallet turns scam => you lose everything

If the online wallet gets hacked => you lose everything

If you get hacked/infected => you lose everything

If the security scheme or RNG of the online wallet is bad => you lose everything

If you fall for a phising link => you lose everything

---

If you use at least a half-decent wallet, most of the things above do not apply... You should be the only one in controll of your keys, you should be in controll of the software running on your system, you should be in controll of generating new addresses, signing, managing, broadcasting...
Sure, things can still go wrong if you make mistakes, but at least they were YOUR mistakes, not the online wallets'. And IF things go wrong while you're using a decent wallet, at least the rest of the community *might* be able to help you fix things.