True.

I may be wrong here - but is the private key only required to send the money? So, if the user kept the key and it wasn't recorded on the server...or if they use some type of password hash for encrypting it, then there wouldn't be hundreds or thousands of wallets stolen at once. The user would enter their password when they want to transfer funds, the hash is calculated, private key decrypted, transaction made, and the private key is never recorded anywhere.

But, this would require the user to NEVER forget their password, or else they lose their money.