It's standard that widget publishers require to use their widget "as is". That's basically what Facebook is saying. Not only do you not know what any custom modifications will necessarily do but it's a completely valid argument that you want a consistent user experience with your widget.
As for user tracking, this is basically an inevitable byproduct of Facebook hosting the widget, a situation I'm sure they're not unhappy about, but this really isn't a big deal in the context of how the Web works.
The story here (IMHO) is trust. Most pages have a Google Analytics tracking script on them. Do you trust Google? I do (disclaimer: I work for Google). Protecting user data and privacy are key priorities here. It's why Google+ has relatively simple privacy controls and allows you to export your data at any time.
Do you trust Facebook? I don't. Then again, there aren't many companies I do trust. But Facebook's track record seems to be to befuddle the user and trick or opt them into sharing things wider than they understand or want.