They don't, officially. Nothing is stopping them from updating the client to siphon your passwords or the encryptuon key, though. This is a problem all password managers have.

It would be nice to have some kind of communication protocol that could be provably restricted from passing whatever the company wants.