You are right. What you say about Facebook is true, but Google's Android is open source, so there is no way they can plant a privacy-invading code and get away with that.
The reason why this doesn't happen with Android is much more mundane: most Android phones are not encrypted so the FBI doesn't need help to read all the customer data. They just need to open the phone and dump the flash.
Compare and contrast with today's "Typo in PHP's Mersenne Twister" story - https://twitter.com/i0n1c/status/699860681487708160
Seems to have been broken since 2007 (the 'broken' line appears in the 2007-01-01 commit "Bump year" but not in the 2006-10-06 commit "Mark rand.c functions with U.")
Ruby on Rails is open source but that doesn't mean that all applications on rails are open source.
That will certainly change quite soon. In the earlier days, FOSS was not a concept that masses were aware of, but now is different. There is increasing competition in the smart-phone world and if one of the other manufacturers (say ASUS) makes their Android modifications open-source, they will see a drastic increase in Sales. To keep up with competition, Samsung, etc. will also have to do the same. In other words, competition will ensure the success of open source.
Can you expand on this? I don't think enough people care about source access. RMS's exact hardware choices don't go on to sell millions.
edit: I didn't see your username before now.