why not just store the permissions granted on your end as you get them. why do you need to ask facebook?
What if, for example, this is a pure client side application that doesn't store anything in a backend database? Everytime a user comes to your site, you can check to see if local storage has anything sure, but if they're on a new computer or have cleared their storage, you're in the dark.
Another edge case: say you have millions of users, only 1000 regularly visit the site. You would have webhooks for a million users updating your backend, rather than just confirming permissions with facebook whenever they arrive to your site. The hop to facebook is probably just as fast, if not faster, than checking in with your own backend. Let Facebook take the brute of the traffic ;)