Yes, you are right, of course. Private keys is something sharks and other predators are looking for, permanently.
However, using private keys directly helps save time which is more valuable than money, sometimes.
I never had problems with web wallets before.
Regarding your other questions, my browser didn't open MyMonero.com. Then I saw myMonero.co, looked for reviews on TrustPilot, found nothing, and my thought was that it's just a recent mirror of MyMonero.com. I decided to risk to save time - and lost both, time and money.
Still, there's no reason for you to type it on a
live website.
When dealing with private keys, treat them like cold wallets - download the HTML page source if you trust it,
disconnect the internet connection, then restore the wallet - create transactions as you see fit, after that then you can transport the signed transaction to a live computer for you to broadcast.