Security issues rarely arise from explicitly malicious behavior. It's usually careless attitudes until the holes in the swiss cheese align
however
it's also a feature transmitting information in a product that bills itself as being offline. imo it's a (minor) privacy violation, not a security violation.
This is the problem. You do not know what you do not know. There have already been papers written about the problems with HIBP. You don't have to understand the threat model for it to exist.
The papers written about HIBP, one of which I contributed to, address some actual problems. but this isn’t one of them