After taking a look into Facebook's API, I concluded that you are right, although some details are missing.

With the process you described, it would be really easy for apps to simply use another app's id. So, it seems that Facebook has implemented additional measures to prevent this. (e.g. using bundle ID and iTunes app store ID for iPhone apps)

Also, Facebook published iOS SDK that required secret key, but has since updated it to remove that requirement.