I agree with you that permissions and a sandbox that actually works would have to be part of any solution.
But you can rest assured that Facebook wouldn't have made such a fuss if all that was at stake is losing access to IDFA and getting slapped with some unenforceable privacy warning.
What's creating a real problem for Facebook is the enforceable legal obligation that Apple has put in place as a precondition for being allowed on iOS devices at all.
It works exactly because it is not a technology based solution. It has created a choice that we didn't previously have.
So I wonder how we can keep this choice without making Apple this all powerful, rent seeking, patronising overlord that also happens to be an ideal attack vector for censorship happy authoritarian governments all over the world.