An event that trigged it for me: visiting break.com (after previously logging into facebook) resulted in a Break application being added without consent.
These are under the "Authorized" applications or just "recently used" ?
It is disconcerting that they show under recently used, but in no way is facebook adding "Authorized" apps at random to peoples profiles.
The friends thing mentioned in the article has always been that way. Every connect site is an app, go to an app you can see friends who have installed it, as it always has