It's important to recognize that this is not an exploit or high-tech exfiltration: it's extremely well-documented in https://developers.facebook.com/docs/refere

It's important to recognize that this is not an exploit or high-tech exfiltration: it's extremely well-documented in https://developers.facebook.com/docs/reference/javascript/FB.. https://developers.facebook.com/docs/reference/javascript/FB.... and https://developers.facebook.com/docs/javascript/reference/FB.. https://developers.facebook.com/docs/javascript/reference/FB.... - the Facebook library even assumes that potentially multiple scripts may be checking repeatedly, and caches accordingly. Facebook is incentivized to make it as easy as possible to integrate their login across the internet, and that entails removing any requirements such as server-side processing that would discourage every tag from including this code. Maybe I am reading this wrong but if Facebook makes an assumption which is inherently unsafe and publishes it. And then someone utilizes the unsafe assumption to siphon data, the ball is still in Facebook's court. They have to ensure that scripts cannot do this. Sure, this might make it difficult for anyone trying to develop using Facebook library. But that is still better than asking people to read T&C and ensuring data is not leaked.