Is the downtime (at the time of writing) their way of blocking a known ongoing attack that can't be stopped fast and safely enough by other means?
Something like: 1) take everything down, 2) fix the bug, 3) deploy everywhere, 4) start everything up.
And, to stop clients from connecting, take down the DNS too. DNS is also a great scapegoat.
Over in WA land, we'd probably just kill all the frontend servers if needed. For all of FB infrastructure, killing all the loadbalancers would probably work, and also the outgoing proxy hosts, as appropriate. No need to mess with DNS or BGP.
It could be the only way to go in the highly unlikely scenario that attackers are able to compromise the management APIs of various infrastructure devices like routers, baremetal servers etc.
These APIs are usually on airgapped networks though, which makes this extremely unlikely