What's to stop a hacker from serving you malicious javascript that steals your unencrypted private keys?

blockchain.info is no more secure than any other web wallet.

They have a browser extension, so there's that. Two-factor involves trusting them, but the actual bitcoin transactions apparently not.

Myself, I only hold pocket change in blockchain, the rest I hold on cold storage.

Regarding them being shady, they are as shady as you all silicon valley fellows. :) I hear that's where they are based.

I don't know how blockchain.info actually works. If you give them your decryption key at any point, even if they claim not to keep it, then you're heavily relying on trusting them and that's not much better than the other web wallet alternatives, I agree.