He's one of the site's longest-standing users, but his arguments aren't making much sense. I'm sure he can do better, but he's too stubborn to let this go.
I have seen this with a lot of old-timers. I wish this site were a little more relaxed in general.
"What isn’t mentioned in the analysis is that we ran a System 1 decision model on each dataset to determine whether it contained privacy-sensitive data. Using a confidence threshold of 85%, we found that nearly 4,000 websites leaked such information."
This to me is proof that you actually downloaded the data, you would not have been able to present the conclusions that you did.
Anyway, I wish you best of luck with this whole affair, you did a great job at identifying a vulnerability, and then you turned it into an actual data breach. I hope that lawyer is willing to sign off on you having destroyed the data because that might become a very important issue.