He left out an important reason: That Facebook can and will ban apps at will, regardless of whether or not they have actually done anything wrong. IMO, that's probably where the "uninvestable" comment mentioned in the article came from. If you have to wake up every morning wondering if your app that had X million users last night is still alive, that's a big problem.

I know of apps that have been banned because malicious actors were using access tokens from those apps to do spammy things even though the app itself wasn't sending those requests. Facebook returns access tokens in the URL upon authorization, so the user is exposed to it and can use it for anything they want. Given nothing more than an app ID, any user can send spam posts and make it appear to have come from any app they choose. This includes Facebook-owned apps.