I always thought that people hired to pen test are white hat hackers? What is the difference to red team?

I think they meant your info being sold on dark web markets, not your behaviour on the dark web being sold.

No, they just put it as background music in their videos, but didn’t actually pay for it. I would guess it constitutes fair use?

I am not sure as well, but maybe they meant “maybe an early and public disclosure increases the urgency of the fix for the developers”?