“We analyzed the network traffic when the app syncs the secrets, and it turns out the traffic is not end-to-end encrypted.”
Google Authenticator finally syncs 2FA secrets across devices, and Google can read every one of them. There is no passphrase option to lock the seeds to the user. Anyone with those seeds generates the same one-time codes, so a breach of your Google account now hands over the second factor for everything else. The feature that fixes losing your phone puts all your eggs in Google’s basket.