The security of a wallet depends on the user, if the user knows how to protect its wallet from attacks and hacking attempts it is 100% secure.
Exactly, if a user use the exact myetherwallet website then the person will not be loser. But if the person use any malicious site or fake site where the person enter private key then the person will loss everything as fake site can store that private key.
That's why it is always good to check the website before accessing the wallets and sometimes it is not good to open outside from your laptop because by chance you might click other fake address which they will steal your private key.