It's like saying that Pingdom is nothing more than a cron job.
In some of his articles discussing various breaches, he mentions reaching out to selected (potential) victims to verify some of the details.
Doing that does require a fair amount of trust by various victims of the people asking to verify.
If I was randomly contacted to verify some details in a breach, I'd be skeptical it was a phishing scheme.
If I was randomly contacted by Troy Hunt / HIBP - then I'd look at it much more seriously.
It's like saying that Pingdom is nothing more than a cron job.