Why is a Flush needed in the MSI cache coherency protocol when moving from Modified to Invalid?
I believe in these models that there is no direct access to another processor's cache; values can only come from (a) the main memory or (b) a bus snooping operation.

I would also look at this from the perspective of the programmer's model of the synchronisation instructions on the CPU. There will usually be "compare and swap" and maybe an "atomic increment". Both of those require the old value.

The "stale" cached value absolutely does have to be invalidated in the cache of the other CPU, and I think you've correctly understood that.