More importantly, since HIBP sells monitoring services to 1Password, if they were maliciously collecting this data they would be immediately sued to oblivion.