Chrome offers the ability to auto-fill passwords without you as a user having to enter any kind of authentication other than being logged onto the machine. This means it has to have all of the information required to access the stored passwords while running in that context.
This means that any other applications running in that context (under your user account) can also access that information.
The only thing Chrome can do is use Operating System level protection to stop other users reading your data. Under windows it uses the CryptProtectData function. This encrypts the data with your windows user credentials - including your password. If you forget your password then the data is unreadable - even if an administrator resets it (although with chrome passwords they are backed up online and would be recovered next time you logged into it with your google credentials).
What do I misunderstand about security?
Any software running on your system under your own user or an administrator should be assumed to have access to everything that you do. If it couldn't read the password out of the password store there are numerous other ways to get it. From the clumsy (start chrome, point it to chrome://settings/passwords and read them out of the UI) to pulling either the passwords or the Google API key out of chromes memory while it is running or injecting a fake root certificate and man in the middle-ing a connection to the website where the password is sent.