Or maybe just found a way to dispose of it for free - doubt anyone would be paying for shredded paper to use as confetti.

Surely police departments aren't allowed to hand such sensitive data to just any external processing company?

I don't know about police departments, but every big company I've ever worked at outsourced their shredding. Any sensitive documents went in the shred bin, which was periodically picked up by the shredding company. It makes no sense to me either.

I think the security level is different. I wouldn't use a shredding service to dispose of old checks or my social security card, but for things that don't matter to the real world like performance reviews or meeting notes, I think it's fine.

Everywhere I've worked, the bin has always been "secured" with a three-pin lock that can be picked with a paperclip. That's a good way of expressing how seriously document destruction is taken.

If you have really serious security concerns, there are companies that will shred your documents on-site and then take them away to be burned.

I know at an ex-employer of mine, we chose to use an outsourced shredding company mostly because of legal reasons. I'm not entirely sure how it worked, but since we were handling PHI (patient health information), we had certain rules we had to abide by, and were liable if this data got out. Apparently, the outsourced shredding company insured us against some of these liabilities. I imagine police departments have similar situations.

Why not? Lots of them will come to you, so the difference is owning and supporting the shredding machines or dropping the papers in the chute and seeing confetti spew out the other end, proof enough that it's doing what it's advertised. Some shredding companies have large incinerators too, another large, expensive piece of hardware that every single police department probably can't reasonably afford.