Cloud sync is opt in and I don't know why anyone in their right mind would enable it...
That being said, using a closed source application packed with features (also known as "attack surface") as your main input method clearly isn't ideal.
Well, I do cloud-sync but it's super helpful. I don't know if SK would be SK without cloud-sync.
How else does it know what to predict without logging what keys you press?