Why not just make two policies: one for bigcorps where there is a big (but friendly) "your boss can read your messages and we'll tell you when it happens" at first sign up, and one for normal, sane, organizations where the old TOS simply remains?
Thats basically what they described isn't it? This compliance export feature is the only thing that allows reading private messages, and it is disabled by default and requires significant hoop-jumping to enable. So for most companies the original privacy policy will apply effectively.
That's almost assuredly what's happening in practice. Large companies/orders have the leeway to reasonably negotiate with Slack. In cases like that, the standard policies set the framework for where that negotiation begins.
