What the setting does
Every bot has a privacy mode controlled by its owner in BotFather. While it is on, Telegram delivers only messages that concern the bot: commands, replies to it, and mentions. Everything else people say in the group is withheld.
That is a deliberate protection by Telegram rather than a fault. It also means a bot added for moderation sees almost nothing until the setting is changed.
How it looks when it is wrong
The symptoms do not point at the cause, which is why this costs people an evening. Anti-spam never triggers. Analytics shows almost no messages while the group is clearly busy. Word filters pass things they should catch. Everything on your side is configured correctly, and the bot is an admin, so the search goes everywhere except the one place it should.
Changing it
Open BotFather, pick your bot, go to its settings and turn group privacy off. Then remove the bot from the group and add it back, because the permission applies to how messages are delivered from that point on.
If you did not create the bot yourself, only the account that created it can change this, so a bot borrowed from somebody else stays limited until they do it.
What the bot then reads, and what it does not
With privacy off, the bot receives the group's messages so the modules you enabled can act on them: moderation, filters, analytics. It reads them to run those features and nothing else, and the retention window for stored messages still applies. Turn a module off and that reading stops being used for it.
The honest trade-off
A bot that cannot read the group cannot moderate it. If you are not comfortable with that, run the bot with privacy on and use it for commands, welcomes and the shop, which work either way. Picking the limited version deliberately is reasonable; picking it by accident and calling the moderation broken is the thing to avoid.