Incompetent is a pretty strong word. If you are asking for permissions X, Y, and Z, and the contract with Facebook's API is you either get all three or you get

Incompetent is a pretty strong word. If you are asking for permissions X, Y, and Z, and the contract with Facebook's API is you either get all three or you get zero, I fail to see why a programmer should spend any non-trivial amount of time coding defensively if that contract were broken. (All other things being equal, there are bigger fish to fry.)