The DCR Delusion: Measuring the Privacy Risk of Synthetic Data