Essentially yes. Google or any number of hackers could intercept your private credentials and use them against you. There is no encryption when syncing authenticator apps.