I run Phobos Group, and I travel all over the world giving presentations about security.
I am very well acquainted with HIBP, and have met troy in the past.
I helped deploy 1password at twitter when I was their sole red-team staff member in 2011.

I am still not happy that home assistant, without my opt-in, without my permission, scanned my HA installation and send stuff up the line to HIBP.

This should be an opt-in feature, and not something that 'just happens'.
As a red teamer, I can give you a list as long as my arm about how I could abuse this to loot credentials from every HA install on the planet.