In theory.  And disappears for any reason (e.g., they were deemed illegal and the assets seized by the authorities.)

In practice the most likely forms of attack would seem to me to be

 - a careful exploitation by the operator or powerful network player to subvert the JS and harvest the info necessary to obtain the secret keys.

 - user platform based attacks which would do the same.

I would not expect either of these to be a 100% immediate loss to all customers as is the case with more simplistic wallet services (and scams) like inputs.io.  In the former case it would, hopefully, be detected prior to everyone being effected.  Especially those who use their wallets irregularly.  In the latter case, I would expect it to hit a minority of platforms (e.g., just Android users or just Firefox users or some such.)

 - edit: s/Windows/Firefox/ for better illustration.