I remember doing security work for a few companies at the time and discovered some standard SQL injection vectors in databases with upwards of 50k access tokens

I remember doing security work for a few companies at the time and discovered some standard SQL injection vectors in databases with upwards of 50k access tokens. It's unlikely, but entirely possible that someone could have stolen access tokens from apps, and subsequently stole user data from Facebook too. At the time, signing into apps with Facebook meant you were not only giving the app access to your account, but also anyone clever enough to steal the token. In some cases, "clever" even meant anyone who had a basic understanding of sqlmap or other pentesting tools. In theory shady "analytics" firms could have hired a low level security researcher and had him use shodan and sqlmap all day to expand their databases. Today it's pretty rare for apps to ask for intrusive permissions, and people tend to be a bit more wary of apps that do. Facebook has also made an effort to alert users when the permissions requested are more intrusive than the usual email address and profile picture - often requiring explicit agreement to these permissions. Nonetheless, if Facebook's "audit" turns up apps that did a lot of suspicious queries, what stops them from saying "oh we were hacked someone took our tokens from our DB, we are conducting a full investigation". Sure it's still bad press, but it's probably better PR to look incompetent than creepy.