Valve just doesn't care, they don't care about much these days. These privacy settings changes, just like their refund system, are due to EU laws.
The privacy change is for the better, any such information should be private as a default state without any "terms and conditions" attached to maintaining it, unfortunately it takes laws for such decencies to be the norm.
Companies seize opportunities to make change at a low public relation cost.
Nothing different here.
The refund system is foremost to enlarge the PC market. Steam collect data about the PC landscape and sell it to devs so they can determine their market target.
The refund policy helps to enlarge the market by allowing customers who are unsure a product runs on their PC to buy and test it. This is the only test the policy refund allows.
Unrelated to the EU laws, except Steam saw it as an opportunity to operate a change.
On the privacy stuff, EU laws were another opportunity to change at a low PR cost.
Lately, companies seized that opportunity to get customers to log in in order to use their products. Up to now, products could be used without that constraint. Another effect is also the increase in notifications.
The EU laws have brought no change in TOS. The main change it brought is that companies are now secured in asking customers a proof they have read and consented to the TOS.
They closed a loop hole as people who use a product without registering an account and logging can argue they ignore a TOS.
Another benefit from the EU laws is that they give tools to control the market better: alternative products to use a service are now weakened position as data can be closed at will from them.
Alternative products that were known to farm little to no data from their customers, were ad free, were not committed to profiling etc
The EU laws have not increased privacy for players: they keep signing the same TOS and consent the same way to see data about themselves collected and spread around to companies that have the same TOS of collecting and spreading.
It strengthens privacy for devs as they are ensured data about them can no longer be outted.
It strengthens companies' grip on a market as they are given tools to degrade the quality provided by alternate solutions (that often happen to be less intrusive to privacy)
Most of all, it ensures that all the breaches in privacy, all the spreading of data happen through the consent of the served as people must show their adhesion to their privacy being stripped from them.