Same thing happens if you login to Chrome and have it back up your settings — all those userid/passwords you tell Chrome to remember also get backed up, which is even, potentially, a bigger concern.
But, then, browser password files are notoriously weak (coughLastPasscough), if someone was skimming PCs. And WiFi passwords? WiFi security is near-laughable for anyone who actually wants to penetrate it. And even assuming Google is using those passwords (or the NSA or FBI are compelling Google to hand over so they can), it still requires a physical presence to get to those networks.
Of the various security concerns folks should have, this seems to rate way low on the chart. Indeed, the security aspects of having to go around and ask people for the passwords to those WiFi networks again probably represents a bigger issue than having Google auto-restore the WiFi passwords to your new Android phone.
Embedded Link
Google knows nearly every Wi-Fi password in the world
By default, Android devices phone home, copying Wi-Fi passwords to Google servers. While they may be encrypted, it seems fairly obvious that Google can read these Wi-Fi passwords. And if Google can read them, the U.S. government can compel them to turn over the passwords. WPA2 encryption? Extra-long random password? It’s all meaningless.