And it could happen again..
Your coins would be safe offline -- as in, the private keys are never on a networked machine.
I know that the private key is safe if it is offline, as long as given malware is not interfering. Which has probably similar chances as people trying to inject on my connection.
I'm not sure how you skip from "javascript wallets aren't safe" to "cold wallets aren't safe." The point is that you re-download your wallet software every single time you open up blockchain.info. It's not a one-time thing.
"
If even cold wallets"...
I tried to imply here that just because your private key is on a computer - that was supposedly never connected to the internet- it doesn't mean that it is completely safe. Coupling directly to the previous statement.
I realize that online services are most likely not the best practice and I haven't used them myself as they were going down and popping up, but on my current system I cannot afford 30 something GB of missing space.
I might look into lightweight clients that do not download the entire chain, however I am not sure how secure those are. I will have to read up on that topic as well.