Payment requests don't implement the whole "merge avoidance" concept described by Mike (AFAIK), but at least an important part of it. Otherwise, how about we use this text:

    "But as long as you consistently use a new public key (in some form) for every incoming payment, finding how much millibits you own is becoming increasingly complex".

On security and privacy, it's generally good to "under promise on delivery". It can be risky to suggest someone's business or personal privacy is fully protected when it's not the case IMO.