They are encrypted and the encryption is just fine. The problem is that the key is stored locally on your system and can be used to decrypt them automatically. And crucially, that key is not encrypted, it's just encoded in a well known format (base64). This means that it's trivial for an attacker's script to retrieve them, use that key to decrypt them and send them up to the attacker's Command and Control (C2) server. As an analogy, imagine having the world's best lock on your front door, but you have the key under your door mat. The lock counts for fuck all, because any thief who isn't a complete moron will look under the mat.

You can actually see this in action for yourself, without your passwords being sent to an attacker. NirSoft has a tool called ChromePass which will retrieve and display passwords saved in Chrome. If I run this on my own system, I get something like:

And this works whether or not the browser is running. So, if you get phished, or get hit by an unpatched vulnerability, any password you have saved in your browser is now in the hands of an attacker. And this happens in the first few seconds of an infection. It only takes one mistake and they are gone. And, while we all like to think that we are immune to phishing or mistakes like that, we all fuck up. It happens. This is why we plan for "defense in depth". Keeping your passwords out of a browser means that, when you make that mistake, they don't end up in the hands of attackers.