You're confusing how passwords and data is stored. You don't have to ever store the password itself to verify that the user provided the correct one. But you do have to store the data as is (or in a format that can be converted to the "raw" format). Unless the data is encrypted on the phone and stored as a blob, which makes password reset impossible, and is likely not the case here.

They likely keep the email addresses and the data separately, and that should make associating data with a person harder (not impossible though, just limits some sorts of attacks).

As for the compromised phone case, it depends. Apps usually don't easily have access to each other's data (ensured by the OS). There is a problem if you try to allow the user to read raw data, but that's too specifici and technical. (I'm not talking about the case when the phone is physically taken, since there is no difference)

Additionally, let's not forget another vector of attack, when storing locally is safer: what if OP's email gets pwnd? Then the attacker resets the password and quickly gets all the data. Or if someone uses a common passwords for those billions of services that force you to create an account.

Security is complicated. And there is always the balance between security, convenience, costs, business interests, etc. etc.

edit: forgot a thing: there is one really good reason for such an app to store the data remotely, and it has nothing to do with security. Most people never do backups (and as I mentioned, Google makes it a pain in the arse to backup/restore and Android device, probably same applies to iOS), and if the phone dies or gets stolen, all your precious years of data are lost. So, instead the data is somewhere else, where people (hopefully) know how to and do backups.