ok ive dug a little in github and yes, alby extension is encrypting with password and only storing to browser.storage.local so then it should only cross via cloud sync of the browser which is out of albys hands
Discussion
of course, i dont have sync enabled so im missing something of how it happened