I would guesstimate that around 90% of all passwords these days belong to web-based services, for which everything you just said is still true, with the excepti

I would guesstimate that around 90% of all passwords these days belong to web-based services, for which everything you just said is still true, with the exception that they aren't run by Troy Hunt. There is an extraordinarily long tail of sites for which "run by Troy Hunt" would be a huge improvement. Actually I bet my guesstimate is way too low. Furthermore: if you're using unique random passwords anyway, then there's no sense in checking them against HIBP, and if you're not, then punching them into HIBP is how I try to convince people that they should be.