I'm not doubting it was overwritten (sorry, my previous post was worded poorly). What I'm most confused about is how it didn't error like in the previous example.
Glad you've recovered it. My recommendation is to move the custom HTML to the privacy_policy_text phrase from 2.0.6 onwards and change the privacy policy URL option to just point to "Default".