Yes, opt-in is the beginning, middle and end of the problem here. Google has plenty of tools to inform users of these capabilities and allow them to turn them on or off. I wouldn't even mind if they nagged me a couple of times with a pop-up about browser log in, or a confirmation that I want to keep or delete Google cookies. But on-by-default features have a special responsibility to be conservative with a user's privacy.

I actually value and use sync. Google sees most of by browsing through page-hosted GA anyway! But at best, this was really lazy product management that smacks of condescension about less technical users (don't worry your head about these cookies). And at worst, it's testing the waters on some really nefarious strategies.