It's a password management system - it's not "gathering" passwords, it is being explicitly given passwords by the user. This is a very important difference! The entire point of the application is that you give it your passwords and it keeps them secure.

The designer felt that "secure" included "is this password already published, online, in a known database breach", which is not an unreasonable interpretation.

The documentation has been clarified. There was a a feature flag. Calling this malicious is just absurd flame-bait.