But only when one has already access, doesn't it? When one hits a paywall without access and clicks the bookmarklet it would only show the login page in instapaper.
This is not correct; the bookmarklet sends along the contents of your browser at the time you click it. Thus it can get around paywalls without having to have your login info.
I believe Marco has said on his podcast that URLs added via the API do get slurped from his servers, but I'm not 100% certain on that.
I think ksherlock is wrong. Marco explained somewhere that he doesn't store for a url the content only once (like the url serves as a hash), but stores the content of a page for every account uniquely (his database is somewhat 200 GB). I also did find this: