Referral source is a built in feature in browsers that analytics tools can utilize. It does not require any special links.

It just means that a website (almost) always knows the previous page you came from.

Likely not, but definitely depends on the situation.

And how do you know the backup is not compromised?

I think it's not as clear cut. It's always a risk assessment and depends on context.

I have to say that I'm not a security expert, just an amateur with conceptual understanding of the topic and some opinions.

He did say "HOPEFULLY just innocent mistakes..." Which we all should hope whether we think all allegations are true or not.