Last time I checked they used custodial wallet and old style format Bitcoin addresses starting with 3.
Correct, LCS wallets aren't truly non-custodial. While they may advertise otherwise, the fact that users don't receive their private keys immediately after signup suggests a custodial model. Generating private keys directly on LCS servers would create a significant security vulnerability, making them susceptible to hacking.
Furthermore, it's technically challenging, if not impossible, to create truly non-custodial wallets within a web browser. The limitations of JS prevent the secure generation and management of private keys without significant server-side control, making the claim of non-custodial wallets quite misleading.
To achieve true non-custodial control, private key generation and management should occur locally on the user's computer or on a server under their sole control.