I was told, to my surprise, by a couple of Bitcoin developers just the other day that they aren't to be trusted either. Apparently they are known shady.

They don't hold your unencrypted private keys.

What's to stop a hacker from serving you malicious javascript that steals your unencrypted private keys?

blockchain.info is no more secure than any other web wallet.

They have a browser extension, so there's that. Two-factor involves trusting them, but the actual bitcoin transactions apparently not.

Myself, I only hold pocket change in blockchain, the rest I hold on cold storage.

Regarding them being shady, they are as shady as you all silicon valley fellows. :) I hear that's where they are based.

I don't know how blockchain.info actually works. If you give them your decryption key at any point, even if they claim not to keep it, then you're heavily relying on trusting them and that's not much better than the other web wallet alternatives, I agree.

They don't actually "hold" your coins (nor your private key(s)).

To expand upon this because I think it's interesting and not something that everyone appears to understand with how the blockchain works: those are effectively the same. Everyone's coins are distributed across the entire Bitcoin network, and everyone who has a copy of the blockchain has everyone's coins, but only those who hold the corresponding private keys for each address (public key) the coins belong to can use them. So if you don't control the private keys to your coins, you don't control the coins.