The way it works is that it’s encrypted server side with your password.

If the server isn’t infected, they can’t read your email. If the webmail server is infection, they could store your password on author (instead of just hashing it immediately) and decrypt your email.

The mitigation to this risk of server integrity compromise is PGP