I didn't realize it when I wrote the above, but this makes my case much stronger: these special entitlements are listed as part of the app. It's far from obvious to the end user, but people who know how to look at them can do so. Either nobody knowledgeable has ever looked at Facebook's entitlements, or it doesn't have one that would let them do this.