Which in turn really means it's no more secure than, say, DropBox.
At least that's the impression I have regarding why this is somewhat important.
If the Feds decide to raid MEGA again they can simply modify their server side script to recognise your IP and serve you bad JavaScript from the MEGA domain, revealing your keys the next time you login. Nobody would be any the wiser.
Personally I'm waiting for JS crypto to take off big time and idiots to start using it from a CDN.
That's why mega has a separate app: https://mega.co.nz/#chrome
So far they market heavily on the fact that it's secure when this is simply not true.
If you read their security page, they do say you shouldn't use it if you don't trust them. But that's about it for any warning that you're basically sitting there naked.
I know no security system is entirely secure, but they aren't generally targeting security minded folks, they're targeting the layman who reads what they say and then thinks they're secure due to their weasel worded security page.
At least with MEGA you know the security framework is something they've engineered themselves, so you know you have to trust them. With SSL/TLS you're deferring to authority simply because it's convenient.
Of course, if you've not cleaned your trusted certificates, someone like CNic can just MTIM you.