Surely, the extension uses a public API. The extension acts on behalf of the end user. So, I think facebook can ban a particular API key (tied to a packaged ext

Surely, the extension uses a public API. The extension acts on behalf of the end user. So, I think facebook can ban a particular API key (tied to a packaged extension), but they would have to ban all chrome extensions to get around someone taking the extension source and building their own. So I think facebook can by disabling the API, but won't do that since there are extension that it does like. Whether FB has legal grounds to go after users using such an extension would depend on the user terms, which I don't really know. It would be fairly egregious and risky for FB to do so. But I think if someone were to open source such an extension, this someone probably does not him/herself expose to a legal risk (speaking as a non-lawyer, and not giving legal advice)