Except that providing an API to a third party, without controls, makes Facebook complicit. They don't get to provide such an API to a third party and then disav

Except that providing an API to a third party, without controls, makes Facebook complicit. They don't get to provide such an API to a third party and then disavow themselves of any responsibility what it is used for. Whereas if the manufacturer backdoors the browser of the phone to steal or siphon data from Facebook users, Facebook's only fault is creating the unnecessary data hazard itself (which is merely irresponsible instead of illegal in the US).