The Chinese police state at work:
Anyone who arrives at a city in China, any city, is required by law to register their with the local police department within 24 hours. Registration includes ID/Passport and address of where you are staying. If you are renting an apartment or staying with locals you'll need to present the rental contract along with the ID of the owner of the apartment.
In the case of hotels, it is mandatory for the hotel to have a police liaison (in most cases the police have a backroom desk at the hotel) with a computer linked to the national ID system. Tourists and visitors never know about being logged by the hotel.
Each time you travel within the country your ID/Passport is scanned at the airport and/or train station. On arrival at your destination you are scanned again by the hotel. If you travel by car and stay at a private home, your movement is traced by the car plate and your mobile phone signal.
There are more cameras in China than anywhere in the world, and most are connected to the central ID system for monitoring.
It is probably more a case of Marriott working with the government to meet the strict requirements for monitoring and not having a clear understanding of the vulnerabilities. My guess is that every hotel company doing business in China is comp'd, and that pretty much includes ALL OF THEM.