If you're running geth on localhost and you come across my web page,
is it not possible for me to just unlock the account and transfer the
If what you meant by my web page is you are providing a wallet like service, yes you can.
Let's say you provided a webpage and for the user to interact using their own local node and you ask them to provide the password to unlock the account, you may retrieve the password from that and somehow find a way to access the file system of the users computer(just like some hacker find a way to enter a system) and get the keystore file.
But the main problem is why people should trust your web page or service?
If you want to others to show that your web page can be trusted , I may suggest something like , that you provide the interface to interact with the ethereum if the user has unlocked his account on a locally run node or metamask like service. So even though you get access to keystore file, it will be hard to decrypt them to find private keys since you dont know the passwrod/phrase.
How wallets work is that they generate a cryptographic key pair and store your private key encrypted locally. So when you provide the password the key is decrypted and used to sign transactions. You may read this post for more details.
how ever the wallets are not 100% trusted. That you may sometimes still have to trust the wallet service providers. There's a good read here.
In conclusion I may suggest you to use a metamask like service to build a trust-able dapp. This question also will be useful for you.