It does however request hash prefixes, then google sends to the client all bad URLs that match, that is what can be brute forced with relative ease, if you already have a stream of previous they are visiting (via google analytics, google captcha, and other matched hashes). Especially if you know most every URL on the internet already. (hash them, then look it up in a table).
Anonymization is a very tricky subject, and there is a lot of techniques that get trumpeted but are absolutely not effective assuming a bad faith actor.
