Of note with this, it's hashing both the username and the password - likely useful if you're using unique usernames (or email addresses) at different sites. The image is inconsistent as to whether it sends only the hashed username or the hashed user+pass, but it might not be surprising to see it do some combination of username, user+pass and just password at some point, thus giving an indication of either "this username has been in breaches somewhere," "this account on this specific website has been in a breach," and "this password has turned up in breaches."