If everything this "security team" from the article has said is true, this domain is Persona Non Grata. Its an armed nuclear warhead. There is no positive outcome for this story that begins with "And then the domain was bought by".
Its Microsoft's "responsibility" to "clean up after their mess". No; We're beyond fighting about who should take responsibility. Throw the ball in Microsoft's court and they'll offer $20k. Throw the ball back to O'Conner and he'll say it's worth far more. He throws the ball to the market. Terrorists notice that, wait, actually, that ball is a nuke. Cool, its at auction; Microsoft now has to pay millions of dollars. So our two options are: Microsoft buys the thing and we're safe, or they don't and we're fucked, and a couple people on reddit are mad at Microsoft for cheaping out, but they live on like it never happened, and we all forget for 18 months until, one day, at the top of hackernews we get a nice new HaveIBeenPwned.
At this point, this domain is like example.com; IANA owns that one. Its too generic. Its used in documentation. People mistake it for being meaningful. The only reason it hasn't caused issues is because the owner has, all thanks to him, not intended to cause harm to the public. But we're now in a place where we can do something about it, and this domain should be removed from public registration.