As of 4 years ago every app needs to be whitelisted by Facebook for every permission they want to request: https://developers.facebook.com/docs/facebook-login/review/w...
Many apps didn't get updated to work with the new API though (most hilariously, the NYT refused to let me create an account without my friend list in early 2015).