I think the security flaw here is that google is keeping your password unhashed somewhere on their servers.
Passwords are encrypted by default, the other option is to encrypt all synced data.
You should clear your friend's sync data from your dashboard BTW: https://www.google.com/dashboard/