They shouldn't be indexed, but on the 1-10 scale of security vulnerabilities, this is about a 1.05.
OTOH finding it is not very far off what Weev got 3.5 years in federal prison for, though, under CFAA.
The whole thing is just a big misunderstanding.
OTOH, Coinbase and Coinlab (the new Mt. Gox) are the entities I'd trust the most not to be outright fraudulent, since they're venture funded. The founders stand to gain far more by being honest than running off with BTC, and the reputation of investors (including YC) would be harmed far more by fraud, so the only real risk is outside compromise, employee compromise, etc.
Coinbase has done a better job on security than any other BTC entity I've seen (although I've looked at them more closely than all but a few other providers).