dark web scanning is common. the developers would be notified when those signatures appear in dark web indexes .

jfif is just an example. any file format or metadata could be used as a signature depending on the storage type.

There is no indication that this particular breach was ever on the "dark web" before widely being discovered.

Yes dark web scanners are a thing, but just because something exists does not mean it would work for a specific situation. I'm doubtful they would work most of the time.