Society generally puts maximal responsibility on school administrators for the well-being of students, so it should not be surprising that they will take maximal measures in response to that expectation. They are ultimately risk mitigators, not privacy ethicists, what would you expect them to do?