I don't work for FB but in my experience, such decisions are most often times are taken by Product Managers who do not understand privacy implications. They typ

I don't work for FB but in my experience, such decisions are most often times are taken by Product Managers who do not understand privacy implications. They typically try to bypass security/privacy teams to avoid the hassle of dealing with them. Also, Engineering teams are sometimes siloed and do not realize that the data they are messing with is sensitive in nature (MFA phone numbers in most recent case.) Most of these features aren't designed with explicit malice, but usually to further a goal of linking more data, generating more insights, showing better ads and so on and thats what interests most engineers. In many cases of-course, they have tend to hide behind user consent - "The user consented to this very broad privacy policy which allows us to do whatever we want so it's okay." Having said that, FB did hire a bunch of privacy experts to fix institutional issues.