Of course it can. Google can obfuscate it if they like (presumably quite well, being Google), but ultimately it's just data on the machine. Malware has just as ready access to that as everything else.
If I log out of my Google account in the browser, I have a reasonable expectation that things on that computer can't log into my Google account in the browser without my credentials.
