Am I missing something? I understand from the article that he is open sourcing the codebase, not the data...?

All the email addresses are pulled from public leaks, often from years old leaks. Nothing like your analogy, if you're still vulnerable you should consider yourself lucky you haven't already been hacked.

All of which is readily available on tor anyway. It's just now centralised.