I mean, they're not really getting access to some secret Facebook data. They're getting access to the user's data, including their username/password.
Since the stuff they're probing isn't included in the APIs, they gotta have some account info to provide insight into this behavior.
Who is "they"? Gizmodo is not getting access to the user/password neither do they have access to the user data. Quote from the article: the information was stored on individual users’ computers; we weren’t collecting it centrally