Does not yet use on device encryption by default, but this can be enabled. However, your Google Workspace admin may prevent this for Google account's in your organisation.
Without on device encryption your passwords are stored in Google's password cloud and decrypted using a key also stored in your Google account.