[makomk]

As of a few years ago, Android asks users to agree to categories of permissions rather than individual permissions, and adding permissions from the same category doesn't count as a new permissions grant. Based on that description it doesn't sound like Facebook was abusing this since they still required users to opt in. (Though I seem to recall from older discussions of this that in actual fact, the opt-in process they implemented was sleazy and high-pressure.)

If their application only needed to run on newer Android, I think they could rely on runtime permissions and not request this permission at all unless the user actually turns the feature on - but even now about a third of Android devices in use are on versions too old to support this.