This is true, but if they had taken over the site, they could decrypt anything that the site had 'encrypted' (some sites let you either encrypt stuff yourself, or let the site do it for you... which isn't a very sensible option)