The circuit doesn't prevent the first register (the one connected to din) from going metastable. What it does do is prevent that metastable value from propagating into the rest of the circuit.

Let's start with a 1-flop synchroniser. The register will clock in the value of din and align it to the clock edge. All good? not quite.

If din is still changing when the clock occurs, the output may go into a metastable state. If the output of this register is connected to other circuitry, this metastable state will propagate through the connected circuitry. Not good - this can lead to concurrency issues if multiple registers are fed from the same metastable signal, to incorrect values being generated from combinational logic, to state machines entering the wrong state.

What happens if we add a second register? The metastable state of the first can still occur. However the second register always (*) clocks the value one clock cycle later. As such there is now a time gap between the first register and the rest of the circuit.

If the first register goes metastable, but resolves to either 1 or 0 (it could be either) in less than one clock cycle, then by the time the second clock cycle occurs, there is no metastable state when second register samples the value. The propagation of the metastable value to the rest of the circuit has been prevented. There will as a result be either 1 or 2 clock cycles of delay as a result of the second register depending on what value the metastable state resolves to.

This massively reduces the chance that a metastable state will propagate - there is a mean-time before failure (MTBF) that can be calculated based on probabilities - for one register it could be as low as 1 clock cycle, for two registers it can be as long as the age of the universe.

Adding additional registers can further reduce the probability of metastability by catching any metastable values in the second register (in case the first register didn't resolve within a clock cycle). However there is a law of diminishing returns, which is why in most general designs you will see 2-flop synchronisers, and 3-flop in mission critical designs.

(*) assuming the clock is routed with minimal skew.

TL;DR; The circuit doesn't prevent the first register (the one connected to din) from going metastable. What it does do is reduce the probability that metastable value from propagating into the rest of the circuit.

Let's start with a 1-flop synchroniser. The register will clock in the value of din and align it to the clock edge. All good? not quite.

If din is still changing when the clock occurs, the output may go into a metastable state. If the output of this register is connected to other circuitry, this metastable state will propagate through the connected circuitry. Not good - this can lead to concurrency issues if multiple registers are fed from the same metastable signal, to incorrect values being generated from combinational logic, to state machines entering the wrong state.

What happens if we add a second register? The metastable state of the first can still occur. However the second register always (*) clocks the value one clock cycle later. As such there is now a time gap between the first register and the rest of the circuit.

If the first register goes metastable, but resolves to either 1 or 0 (it could be either) in less than one clock cycle, then by the time the second clock cycle occurs, there is no metastable state when second register samples the value. The propagation of the metastable value to the rest of the circuit has been prevented. There will as a result be either 1 or 2 clock cycles of delay as a result of the second register depending on what value the metastable state resolves to.

This massively reduces the probability that a metastable state will propagate - there is a mean-time before failure (MTBF) that can be calculated based on probabilities - for one register it could be as low as 1 clock cycle, for two registers it can be as long as the age of the universe.

Adding additional registers can further reduce the probability of metastability by catching any metastable values in the second register (in case the first register didn't resolve within a clock cycle). However there is a law of diminishing returns, which is why in most general designs you will see 2-flop synchronisers, and 3-flop in mission critical designs.

(*) assuming the clock is routed with minimal skew.