I have no background at all in IT security, but I thought the passwords would be encrypted using a RSA system (the public key would be used to encrypt the password, the private key would be used to read them). The private key would be generated randomly when the browser is built, making it unique, and inaccessible (unless maybe with a debugger, but that's not something that could be done in couple of minutes).

Maybe what I just said is stupid and not feasible, in which case I'd be curious to know why.

I agree with this. The entire promise of password auto-save is to save the user TIME. If the browser locked itself every couple of minutes and asked for a master password between visits, it would not help the user save TIME.

I think the author is confusing a feature exclusively created for convenience with one that would be targeting security exclusively.

PS: However, what better way to get HN traffic than a sensational title like that...

it could for example use the system keychain on MacOS and not expose an interface. Chrome could then read the passwords from the keychain, but any user-access to the password would have to go through "keychain access" and require the users logon password to show in plain. Storage would also be encrypted, so it wouldn't be "security through obscurity" but rather a real step towards protected password storage.