github got compromised few days ago by bored russian teenager, so this method is not entirely bullet proof
Yeah, but it makes it a long shot. I wouldn't choose to depend on a web wallet for my entire fortune, but could still use it for daily small transactions and maybe backup purposes (depending on the scheme).
why not just use trusted open source thin client?
Makes a lot of sense of course. One reason I can think of is a lack of multiplatform thin client that works on all your devices and you are not too enthusiastic about shuffling money through wallets. For instance, I probably could run Electrum on my N900 (not sure) if I spent some time on it, whereas blockchain.info/wallet would work instantly.
A javascript web-wallet with automated backups and a local verifier is analogous to a thin client that has forced updates. Forced updates aren't good though. Also, even with multisig, I'd probably prefer to maintain my secondary keys myself. However, for most people, this might not prove to be more reliable.
I think the structure will evolve to the point where wallets would be portable between clients and the standard two-factor authentication would work through the network itself. Then you can use whatever method is more convenient for you and fall back to the other method in case of emergencies. Even if you insist on relying on online services, you could keep a copy of your wallets on multiple sites. Of course, no combination of these sites shall have clear access to all the keys necessary to complete a transaction (which is tricky if you know nothing about how Bitcoin works).
To make the concept easier to grasp for laymen, banks/wallets and clearing houses/escrows could be totally separated, all of which provide a thin-client service as the standard transaction method (so that you would only need to access remote encrypted keys in case of emergencies). Don't see that happening even in the far future though.