One thing that iOS got right from the very beginning is granular, a la carte permissions. While I have Fb installed, it has almost no access -- no gps, no contacts, no notifications. It cannot intrude, I need to consciously start the app to see anything Fb-related. Same with Messenger.
I've recently removed Fb's media access (called "Photos" on iOS) because I noticed it was doing collages of the photos I took previously during the day -- I would like to think they are not uploading any data from my gallery to their servers, but would not put it past them.
Also, the mobile web version is usable, I think they purposefully hold it back to push people to the app, but you can get by. Because I'm not sure if they're scanning my gallery and extracting/communicating metadata back to their C2, I now do picture uploads thru mobile web, that way they do not have permanent access to my media. Would be nice for this to be an app permission, one-time and/or user action-initiated access vs the current permanent access, which includes unrestricted background access.
Another permissions to disable is "Background App Refresh," which if you have notifications disabled there should be no reason to have enabled. They can send a C2 ping which has IP information and who knows what other device profiling which, even with GPS disabled, can still probably give them a lot of information on your whereabouts. Unfortunately, on iOS, the main Fb app is implemented in a tricky way and does not even list itself in the main app permissions list, you need to find some of the permissions individually, and BG App Refresh does not appear to be defeatable. The Messenger app does list itself normally and can have all the perms turned off in one place.