But I'm saying it should be possible to view the source of the password, not the password itself. Which is what his site already shows for individual breaches.
Are you saying that's the risk of providing the website URL? Or that it's the risk of the HIBP?
Because he does provide the email and the leak name... He even provide indirectly where to download it from his blogpost.
Providing the website won't give more dangerous information, that's exactly what he usually does when it's not a stuffing list, he say where the password come from (Linkedin, Facebook, etc...).
The risk is enabling a service that unlocks a capability like “give me the password for this email address that may or may not be mine”.
The source of a breach is a single attribute that can be associated with an entire dataset, unlike passwords.