Not a security flaw, you just synced his browser settings with your account.
The proper way to log into another person's Chrome is by adding a new user in the "Personal Stuff" area first.
Passwords are encrypted by default, the other option is to encrypt all synced data.
You should clear your friend's sync data from your dashboard BTW: https://www.google.com/dashboard/