And HIBP is an example of this attitude because it collects data dumps and then (at least) collects and retains user-submitted email addresses and a record of presence/absence of such "live" email addresses in the data dumps. This is beyond the scope of what is needed to provide the service, namely, copies of the data dumps available for download. The user need not share their search terms with any third party, such as HIBP. A means to search these dumps locally (offline) without sharing the searches with third parties such as HIBP exists. "Online tools" are vectors for gathering the sort of data that is later the subject of "data breaches". Offline tools do not suffer from this problem.
"6. Data breaches are redistributed extensively. There's an active trading scene exchanging data both for monetary gain and simply as a hobby; people collect (and thus replicate) breaches."
HIBP is collecting and thus replicating data breaches for "monetary gain" or "simply as a hobby"? Or is it something else?
As above, HIBP does not provide users with the data dumps they need to check them locally (offline) without submitting contributing more data to third parties in the process (e.g., working email addresses, associated search terms, associated originating IPs, etc.).
Further, users are not provided with transparency into what HIBP is doing i.e., what it is storing and how and where it is stored. Users cannot evaluate the security practices of HIBP as yet another online repository of sensitive user data that by virtue of its existence could be a target.
In summary, what he is not telling US Congress is that 1. "online services" or so-called "online tools", HIBP being one, are a major part of the problem and 2. there are alternative solutions, i.e., offline service and offline tools, and what HIBP provides is an excellent example of where an online service is unnecessary and is collecting large amounts of user data, unnecessarily.
Addendum: "What I'm telling you" is that I believe the problem is data collection. Any "solution" which collects data, and in this case data it is not supposed to have (e.g., a data breach), then collects more data (e.g., metadata) from users and finally asks users to trust the "new collector" is not a solution, IMO. Especially where the new collector shares no technical details about his operation (e.g. storage of user data). This practice ignores simple, obvious solutions to the problem of data collection, such as performance of tasks offline which if performed online would likely lead to the collection of user data. It reinforces the mindset that perpetuates the problem: that data collection and trusting third parties is always necessary.