Removable storage, SD, USB, etc, was moved from external_storage to media_storage with Android 3.1.
Note that external_storage was still about putting files in an area readable by any and all apps that had read_external_storage permission.
In other words, the change would do jack all to safeguard against idiots like the whatsapp app devs.
Sure there was! Simply generate a random key, store it in the (small) private storage area, and use it to encrypt whatever you want to write. Instant private area!
(many storage media are formatted using FAT, so the media API is probably not implemented using Unix permissions)
As for FAT, I said in another comment that Google has already imposed MTP on us and Android's adoptable storage uses ext4 anyway, so they could easily require it on all removable storage where application data is stored.
Your camera app used to be able to access your WhatsApp backup folder and your documents. It was just a flat file system. Developers would request the permission even though all they needed was a caching folder or something, but they could read and upload all of your documents, too.
This change, while breaking a bunch of applications until they migrate to the new fine-grained API, was a necessary one.