It's probably astronomically less than the possibility of the GLBSE server being hacked, but you are correct, a chance does exist. I suspect that the DDOS protection and speedup will be worth it to the majority of users, however.
Nefario needs to build in some additional security tools, things besides only the cumbersome and annoying two factor authentication, and once a good option is decided on it should probably take top priority. Things like:
1. The ability to require a different password(s) than the login to make change email, trades or withdraw bitcoins, etc.
2. With changes discussed in #1 add the ability to require a transaction PIN code which is sent via email.
3. Perhaps offer a YubiKey option. But being fairly minimalist and one who travels often I do not want another little piece of physical crap to deal with and possibly lose.
4. The ability to 'freeze' an account for a specified amount of time. Or an ability to require a BTC withdrawal to take X amount of time before it is submitted to the network during which it could be canceled.
Just some things that could add enough friction to make it not worth a thief's time and reduce the potential profitability from messing with GLBSE accounts.
Regarding making accounts more secure.
Once a users email has been compromised, and two factor authentication is not enabled there is no way for us to tell the difference between the hacker and the real account owner.
I am going to be adding more security features that will hopefully prevent accounts getting cleared out, but the above mentioned won't do much except piss off users.
We only keep a small fraction of BTC on our server, nearly all of it is in cold storage, I think GLBSE isn't really a worthwhile target for attackers. There isn't much to steal.
