Essentially. The root failure mode of FB's API solution is that it's an API for accessing private data and their only protection against clients abusing that access was a terms of service.

Back in the mid-'00s, we started implementing something against FB's API and I was more than a bit shocked to discover that their solution for preventing someone from building a parallel network of friend relationships out of the available dataset was "Please don't do that, and anyway if you try to do it at scale we'll probably detect the bandwidth consumption and shut you down." Not great.