I was gonna ask about the biometrics part in a separate question, but its both about security, so might as well combine it in one post.
Okay so I don’t use password managers. I just try to make easy to remember passwords 3-4 random words + 3-4 random numbers. Online accounts can’t be brute forced anyways. For offline accounts, I just increase the words and numbers. For mobile I don’t use biometrics, although I’ve been testing whether or not I want a pin + no biometrics or alphanumeric password + biometrics. I just can’t decide.
Sure, probably they won’t use it for bad purposes.
But there’s nothing saying they won’t use them in any way they see fit.
Maybe they could find a way to find monetize without disclosing them and anonymized, like statistics or with the update in their policy about training their models with whatever information they can get.
Maybe you have an ad blocker and AdSense can’t build a profile from you, but the google already know what sites you were interested enough to make an account and could try to advertise in other ways.
And then the biggest issue: there’s no mention of encryption, so who knows how they store them and where. Could an attacker read them? How are google employees prevented from reading them?