It's easy, just by bundling stuff and "luring" users to sync data to their probably-insecure(!) server.
i can't speak to their server. i am not using it. i am not even reminded about its existence. i think you are asked once on setup and then never again. hence there is no luring to it either.
but the key point is: no matter what you think about me: you think i'd do better with lineageOS? i'd be using all the same apps there. so i really can't see how that would be any safer.