[korax]

Here is a point that I think hasn't been raised yet:

You need consent from all parties messaging back and forth.

One party consenting to Netflix/Spotify/etc accessing your chat messages, is not enough.

I would hypothesize, that they didn't only grant access when all sides had consented, as the API was (supposedly) primarily used to share media with your friends, something that's pretty innocuous and shouldn't require "chat message read" access at all.