Key here is "not always". If two users trust the intermediate chain of servers that have access to their messages, then transport layer security is indeed suffi

Key here is "not always". If two users trust the intermediate chain of servers that have access to their messages, then transport layer security is indeed sufficient; that already safeguards against unauthorised links in the chain (the man in the middle). On the other hand, if absolute confidentiality is a concern, end-to-end encryption is required. XMPP does not rule out either approach. End-to-end encryption matters of course, but it is a lot more relevant when one single mega-corporation is in control of every server messages pass through (e.g., WhatsApp). But if, say, you and I decide to run our own XMPP-servers and communicate thus, it may be sufficient to ascertain that a secure channel exists between our servers and between our clients and their servers.