Bellingcat (despite the great work they do IMHO) certainly does not get Russian passport details simply by hacking or by asking some "corrupt" Russians working for the state for help. So you can probably trust most of what they say but not how they get their info or that they are simply a "hacktivist / citizen jorno" outfit (they'd be dead since long time if that would be all)

At least until I've seen them uncover something as big as Skripal or the MH17 (within the FVEY) I wouldn't believe their claims of being "independent". Which will never happen because you don't bite the hand that feeds. Anyone playing in that league will not survive very long (quite literally) unless they get security benefits needed (which requires affiliation).

There doesn't have to be a conspiracy. That protection comes at a cost of bias (it's not required when everyone around you and most importantly yourself believes you're part of the good guys).