Neither: it's because (overgeneralizing) there are bounds on the number of times nonces can be generated under a key without risk of collision, which in AEAD constructions is a devastating event.
For a given nonce collision, how many blocks or messages can be decrypted?
For some modes, you can break every message encrypted with that key.
But shouldn't that bound be astronomical?
I'm fairly out of my depth here, but the birthday paradox is a harsh mistress.
Especially when the pool of possibilities is equally massive
GCM is like 4 billion messages, which is not astronomical at Facebook's scale.
Meta (we) process many billions of messages per second. Finding enough randomness is a thing at scale.
Per day? but not per second. would require every human being sending @ message every 8 seconds
Per second. Messages in the Kafka sense not the WhatsApp sense.