It's like facebook in that the employees had a guarantee of privacy (insofar as most private communication is private; obviously the recipient can expose the message, or someone can coerce you to login to your account). Some people are waving this away with, "oh, probably the employee signed some contract saying that it wasn't private" but even if that's often true it's of course sometimes not true. Certainly I've never signed a contract with that kind of clause, but I've generally worked for small companies.

I suppose there's nothing preventing a company from using facebook as a corporate communication medium. That'd of course not a good idea since they don't have access to some of what goes on at facebook. The same thing was true for slack. Some companies used slack without considering that the data wasn't really under their control, which was perhaps not a good idea. This change is akin to facebook recognizing that blunder, and "fixing" it by making DMs between employees available to their employer.