Both options, bitcoind and blockchain.info API are equally vulnerable.

When the attacker gains to access to your server, they can empty the hot wallet through an API call, regardless if they or your server has access to the private keys. This API call can be blockchain.info API call or bitcoind JSON-RPC API call.

The best practices to strengthen a bitcoin service against server compromising attacks

• Use separate hot and cold wallets, only manually top up hot wallet from the cold wallet. You will lose the ability to withdraw everything at any time, without manual interaction from the team, but this is the only way to prevent losing everything at once.

• Encrypt your server and use bare metal servers, so that your server is protected against physical attacks and malicious hosting provider attacks. You can only put relevant config files containing the API tokens to the encrypted partition and symlink the config file to the right location after manually decrypting the server on boot. This way anybody gaining the physical or service port access to the server is less likely to gain withdraw ability.

Here are some other best practices for operations security.