They aren't sharing it with Brave directly, but rather with users. The query is issued via the participating user's Brave instance. This data then supplements what Brave Search has found, and assists Brave Search in presenting better results to that user, and others, in the future.

This sounds like a dishonest way of bypassing payment for Google search API by impersonating a request from a user.

It's still a request from the user; the user consents to issuing these requests on behalf of Brave Search when they opt-in to Fallback Mixing. Anybody can issue calls to Google's search engine.

Doesn't this get the user directly in violation of Google's TOS which prevents automated queries against it?

What do you think the Google custom search api is supposed to be used for if not serving searches that originated with some user?