Why isn't Facebook doing domain verification for the display domain? There are plenty of ways (email to well-known account, DNS records, etc.) to verify domain ownership. Google is doing that and I'm sure plenty people at Facebook are familiar with the concept.

From a legal perspective, I wonder if the legitimate sites can sue Facebook over that, or if there's a case for class action on behalf of users.

In any case, I don't buy any arguments that claim this is intentional to help actual advertisers or an oversight. From a security standpoint this is a spoofing tool and without any kind of validation or verification it should be clear what this tool is being used for. Facebook's in the business of collecting and analyzing data, and I'm sure they know very well that it's being misused.