I wonder how they did it. The sync data is supposed to be protected by E2EE where the key is derived from the user password or an separate sync password, at least before I abandon Chrome and go FF few years ago.
Last I looked, Chrome’s sync is not E2EE. Next to nothing (user space) is E2EE, in Google’s ecosystem. By default it’s only Encryption in Transit. I think you can enable a Passphrase (encryption on device), but that’s optional.