B does not contradict A. A is the reason that B is true.
The encryption is done with javascript by your browser on your machine. They send the encrypted private key to your browser, your browser uses your password (which it does not supply to blockchain.info) to decrypt the private key so that the transaction can be signed. Your browser then sends the signed transaction back up to their servers to be broadcast.
Since they don't have your password, and they only have the encrypted copies of your private keys, they cannot take/spend your bitcoins.
Of course, that means that if you forget your password, they can't help you. Your coins are just as lost as if you had forgotten your password to an encrypted wallet file on your own hard drive.
Private keys and bitcoin addresses are generated with javascript and only sent to their database after being encrypted by the password stored in your browser. You can have a copy of your encrypted wallet from their database sent to you so that you can store backup copies and still access your bitcoins if blockchain.info were to be shut down.
Thank you for clarification. The security seems reasonable to me now.