Voluntary sharing, since afaik they don't pay the criminals to get the data. Either the criminals share it directly (fat chance, usually), or someone else bought it and shared it either publicly, privately with HIBP, or privately with someone who then reported it to HIBP
How this specific instance unfolded, time will have to tell. The leak may have occurred in 2020 for all we know at this point
There is a strange dynamic between the threat actors who conduct these breaches and researchers.
When not used for extortion and for "status" in the hacking community, they share them with researchers (commonly HIBP) to warn people about a site's security and so that site is forced to fix things.
