> How the f* they did not have them encrypted to begin with?

They are encrypted while transit and at rest, just not E2EE, which is understandable based on the link, but still should be an option like passoword manager in Chrome has.