You can tune how much "a lot" is. In this case, the filter appears to be tuned for a 1 in 1000 false positive rate. How annoying that may be to your customers is up to you to decide. (I'm not sure about the utility in banning every exposed password ever anyway.)
You could also use this is a pre-check before querying the real haveibeenpwned api.
You could also use this is a pre-check before querying the real haveibeenpwned api.