I suppose they use JavaScript to hash your password locally so all haveibeenpwned has is your hash.

It’s certainly not full proof but it means a simple MITM attack wouldn’t be that bad.

The risk would be that the JavaScript in question would be compromised for the whole service. Also if the machine of the user is already compromised well I would argue that password is already useless anyway. If someone has a keylogger on your system, ihavebeenpwnd would be the least of your concern.

So it’s never foolproof but some risk can be mitigated.

Hashes are a powerful tool enabling easy check of leaks without exposing directly any user password.

Edit: Hmm there is much better explanations than mine on hashes on here, probably disregard the above comment.