Yes, they can be stolen but its nearly impossible to do that. Web wallet services are easier to hack if the security isn't taken care of. Offline wallets impossible to hack as they are stored on a computer which never goes online. The transactions are signed offline and then broadcasted on a different computer.