What protects cookies from being stolen? After all, they are just text files. A misbehaving browser can give up a lot more information that web masters would like. How do I know that a browser won't serve up cookies from another domain to my website if it asks for them?
In short, guarantee that cookies from site A won't be read by site B is provided by so called Same Origin Policy (SOP). This is browser security implementation. Sure, if there is a place for code injection (like XSS), attacker can steal your cookies, but that's another scope - in that case client "allows" (but user is unaware) to retrieve cookies by third-party.
Additionally, I highly recommend to read Michal Zalewski's browser security book, or, at least chapter of it: http://code.google.com/p/browsersec/wiki/Part2#Same-origin_policy_for_cookies. Also, nice post about cookies is again from himself: http://lcamtuf.blogspot.com/2010/10/http-cookies-or-how-not-to-design.html.
Some good, related to this question links from here: How can I check that my cookies are only sent over encrypted https and not http? and Are browser still vulnerable to Cross-Site Cooking?.
Of course all this relies on the browser getting it right, and in some cases supporting it. Safari for example didn't support HTTP Only cookies in its first couple of versions.