If I remember correctly you can't request access to any non-public user info without submitting your app first for manual approval by Facebook's staff. So, if t

If I remember correctly you can't request access to any non-public user info without submitting your app first for manual approval by Facebook's staff. So, if there are FB apps out there tracking extra user info, Facebook must have reviewed and approved them, so they are obviously OK with such usage. So it's not an exploit of the platform, it's FB's core business...