What the "corporate veil" generally protects are investors -- only the actual amount invested is at risk, rather than more, or all, of an investor's assets.
The veil can also be used to shield specific executives, another common complaint.
But a third mode is when a sacrificial scapegoat, often relatively low on the hierarchy, is identified and blamed for problems. That shows up in government as well as the "one bad apple" excuse, which both fails to address true accountability and justice, and massacres the metaphore, which is "one bad apple spoils the barrel".
A lone actor should not be able to behave in such a manner, and is quite probably not acting alone. The oversight, detection, and cross-checks which should be required to be in place clearly aren't. That would include the individual's business unit and management chain, as well as the company as a whole.
Note that I didn't use the term "corporate veil", and I'm not entirely certain it applies here (see one definition: http://www.businessdictionary.com/definition/corporate-veil....), though in the sense of shielding the larger part of the corporation and individuals within it, the argument could be made.
Understanding business as a sort of "risk shedding engine" may help. The corporate veil is one mechanism for this, but another is the creation (or post-incident assignment of) what's effectively an ablative heat shield -- some component of the corporate structure, often a single individual, up to and including a CEO, though business units, subsidiaries, contractors, or largely-controlled corporate charities and trade organisations are also used -- which can be shed or discarded as needed.
So the "turnaround CEO", the management consultant organisation, the "rogue employee" (anywhere from the front line to the executive suite), the subsidiary, the spin-off, the "charity" or "trade organisation", all fit this bill.
For CEOs, see Albert "Chainsaw Al" John Dulap (obituary: https://www.nytimes.com/2019/02/05/obituaries/al-dunlap-dead...), or Martin "Pharma Bro" Skrelli. An argument could be made that many major politicians operate in this mode -- the argument might be made for a Boris Johnson, Mitchell McConnell, Fritz "The Senator from Disney" Hollings, who serve as the public exposure of their respective interest groups. "Trade organisations", particularly with an enforcement arm, such as the MPAA, RIAA, and BSA, largely represent firms in the cinema, music recording, and software industries, respectively. Various "think tanks" such as those in the Atlas Network (https://www.atlasnetwork.org/partners) allow specific interests, usually business, industrial, and generally the wealthy, to engage in activities at a slight distance. Many of the Atlas partner organisations are strongly associated with the Kochs, Scaifes, Bradley, Searle, Walton, DeVos, and others. (See: https://www.sourcewatch.org/index.php?title=Atlas_Network https://www.sourcewatch.org/index.php?title=State_Policy_Net..., and related articles.)
In this case, Facebook are avoiding corporate liability, legal risk, and goodwill erosion by blaming a "rogue employee". That strikes me as an incomplete fault analysis, and one that's overtly and obviously self-serving to Facebook, its management, and shareholdes. Most of which are synonymous with Mark Zuckerberg.