That's a valid argument if your threat model only involves other visitors who aren't given access to see email addresses, but it breaks down if you're hiding from the site administrators, an attacker who obtains admin access, and whomever the attacker makes the data available to.

You can still often check to see if someone has an account for a service by just .. trying to sign in or retrieve lost password. You often don't need to have the password or access to the email to tell from the response if there's already an account registered for that email address.