Yes, owners of site definitely could, if they want to. In fact, you don't have sats here, you have IOU against sats. They become your sats only after you withdraw to non-custodial wallet where you control private keys.
You mean, like it could happen with the fiat in your bank account? :D
Btw yes, it’s not a non-custodial solution. If the website/node disappears, “your” sats disappear with it. If your login details get leaked, bye bye sats
SAT
isn't an acronym, it's an abbreviation for satoshi, so it shouldn't be capitalized.