Yes, it's synchronous, but that's not a problem in this example (or really any of Underscore's methods).
The reason many node APIs are asynchronous is because they perform potentially long operations. In order to do so, the work is offloaded to native OS asynchronous facilities (sockets) or done on a separate thread. Only when the work is complete is the data marshaled back into JS land and a callback invoked.
In this case, you're dealing strictly with JavaScript-managed memory. Only one thread has access to JS memory; you can't share memory between threads. This means you must do your work (shuffling the array) synchronously.
Unless you're dealing with a truly large array, this won't be a problem.
The "never make synchronous calls in node" rule really applies to I/O and computationally expensive operations. That's why all the network, filesystem, crypto, and zlib APIs are asynchronous. You'll notice that other APIs like the URL/path parsing modules are synchronous calls.