What I apprehended from the article is that those API's still exist, and even still work in full. Meaning that today it is still possible to generate an access

What I apprehended from the article is that those API's still exist, and even still work in full. Meaning that today it is still possible to generate an access_token using a client_id extracted from an old blackberry device with a valid facebook account and extract much more data (using the private device API's) than what that user should be allowed to see. Do I understand that correctly? Because that seems like an enormous security breach.