Your friend can, but Facebook can scrutinize third-party apps. In a decentralized world, there's no one who has access to holistically examine automated access and detect shady activity. In a decentralized world, everything is essentially a third-party app.
The other thing I’ve seen a lot of people use are notifications / invites. e.g. most big gaming communities are bad experiences but you can bootstrap your friends into a better group. That seems harder to change and it’s definitely a real need.
Basically only automation & power users.
I can assure you that they don't. Anyone can have a third-party app that scavenges for private info.
See: Cambridge Analytica.
>there's no one who has access to holistically examine automated access and detect shady activity
There is. It is you. You can shut off access your data any time you want to. Yes, if you give someone access to some data, that data could potentially be out there forever but you can revoke access to your (future) data freely.
And, most importantly, the same is true for literally any platform.
One quick look at people taking screen shots of snapchat posts shows how deletion of data from a platform like FB or Snapchat is irrelevant - viewers of that data can always copy it.