I can see this being an extremely valuable tool for preventing identity theft on the site. One of my teachers had been the victim of a scammer who had cloned her profile and was reaching out to everyone on her friend list. When the fake profile was reported, it was taken down very quickly, which I imagine could have been done programmatically with this data on the photos.

There's speculation that FB could infer relationships with this. If you've ever shared memes, you'll know this this is unlikely to be effective.

At the end of the day, in an age of reverse image search and public profiles and commodity facial recognition, what is actually the threat model here? That someone is able to tie an unattributed photo back to the URL it was downloaded from? That if someone downloads your photo without permission (why did you upload it in the first place?) and they share it but don't say where they got it, someone else can potentially find out where it came from?

It's unclear whether this ID even uniquely identifies the uploader or downloader publicly. If it's a random UUID, then what? Facebook doesn't reasonably need it to track you (they could use the hash, face recognition, your session, etc). I honestly can't think of a case that would make this valuable to a malicious third party. Beyond content moderation (and maybe saving some CPU time), I can't see much of a use case for Facebook either.