[db3pt0]

> In many cases they are already syncing a copy of your passwords.

No, that gets them the full way there. They have your 2FA codes, and if you use Chrome and opt into it syncing passwords for you (passwords.google.com), this gives them both pieces of the puzzle.

[cleanchit]

If you use chrome, they could just download your cookies if they really wanted to.