Just for clarification: At chromium.org you can find a detailed blog article about the relationship between Chrome, Chromium and Google from 2008
Chromium is the name we have given to the open source project and the browser source code that we released and maintain at www.chromium.org. One can compile this source code to get a fully working browser. Google takes this source code, and adds on the Google name and logo, an auto-updater system called GoogleUpdate, and RLZ
Since 2008 Google has added more stuff which isn't included into Chromium, mostly to avoid copyright issues. Some popular things are: MP3 and AAC support, a Flash player plugin and a native PDF viewer
But what is this RLZ?
RLZ is a library that is built into Google Chrome. It's a tracking ID which contains non-identifying information about where Chrome was downloaded from and the installation date. Everytime you do a Google search from the Google Chrome address bar, an RLZ parameter is included in the URL. Google says this cannot be disabled as long as you use Google as your default search provider.
However, you can try to disable the RLZ by creating a new Google search as default (untested)
If there aren't more differences, can I do more to protect my privacy?
Turn off Instant search. If you don't, everything you type into the address bar is send to Google immediately
Turn off Google Sync. If you don't, every bookmark, passwords and extensions are saved in the cloud on Google servers. Obviously, this is necessary to sync your data across multiple machines. However, you can encrypt your data with a personal pass-phrase. And no, Google employees cannot see your passwords
Turn of location tracking
Disable all 5 options in the Under the Hood » Privacy section. All options are explained at the same blog post I mentioned earlier.
Regarding Phising and malware protection: Disabling it means that you will not be warned before you visit a suspected phishing website, or a website suspected of downloading and installing malware onto your computer.