The final recipient may store some data in the encrypted payload for itself to avoid storing it locally. It can for example put a payment_hash to verify that the route is used for the correct invoice. It should use that field to detect when blinded routes are used outside of their intended use (malicious probing) and react accordingly (ignore the message or send an error depending on the use-case).