Yes, all 3 (user who sold access, "bad actor", and FB as the market maker) are complicit. But the user may make this choice knowing all this, because who believes stuff anyway on fb, or maybe they are politically aligned with the "bad actors".