Well, "needed" is a strong word. They wouldn't have needed the ability to read arbitrary private messages, just the ability to find out when PMs contain whateve

Well, "needed" is a strong word. They wouldn't have needed the ability to read arbitrary private messages, just the ability to find out when PMs contain whatever signal is used to send a payment. If they got any more than that, it wasn't because of need, it was because someone at Facebook was being lazy and insufficiently respectful of user privacy.