Yeah, the very first thing I thought of was along the lines of "Oh, so this is how attackers will compromise a machine and run http://my-favorite-bank.com.holepunch.io/login-and-give-me-a... on a compromised computer."

I do see the benefit of the service, but I think it would be cool if they offered a self-hosted version. A LowEndBox for $20/year gets you a box and an IP to tunnel through.