Neither: it's because (overgeneralizing) there are bounds on the number of times nonces can be generated under a key without risk of collision, which in AEAD constructions is a devastating event.
But shouldn't that bound be astronomical?
GCM is like 4 billion messages, which is not astronomical at Facebook's scale.
Meta (we) process many billions of messages per second. Finding enough randomness is a thing at scale.
Per day? but not per second. would require every human being sending @ message every 8 seconds
Per second. Messages in the Kafka sense not the WhatsApp sense.
I'm fairly out of my depth here, but the birthday paradox is a harsh mistress.
Especially when the pool of possibilities is equally massive
For a given nonce collision, how many blocks or messages can be decrypted?
For some modes, you can break every message encrypted with that key.