It's not actually secure and human meaningful. There are many possible domains at least as legit looking which are not owned by facebook, and so you must either

It's not actually secure and human meaningful. There are many possible domains at least as legit looking which are not owned by facebook, and so you must either have the machine remember that facebook is facebookcorewwwi.onion and not wwwfacebookcomyz.onion (secure) or trust the first domain that looks legit (human-meaningful).