AFAIK they would get the info “which user said what”. The source would be what ever instance you are from tho, not your own ip. So the owner of a instance knows as much as everyone else.

I always thought that people hired to pen test are white hat hackers? What is the difference to red team?

I think they meant your info being sold on dark web markets, not your behaviour on the dark web being sold.

No, they just put it as background music in their videos, but didn’t actually pay for it. I would guess it constitutes fair use?

I am not sure as well, but maybe they meant “maybe an early and public disclosure increases the urgency of the fix for the developers”?

BMW did it: Video link