The article is poorly written and not clear. It sounds like you're suggesting the author let Chrome save his Coinbase password and Google synced that to the attacker as well?

> Google had cloud-synced my codes.

> That was the master key. Within minutes, he was inside my Coinbase account.

The author wrote "codes", not "passwords".