> no-one at Meta noticed that the payload also included 'what deductions that person was eligible for'

I wouldn't expect anyone at Meta to actually look at unencrypted user pixel payloads. Seems like an easy way to lose your job.