If Facebook validation causes 90% of their visitors to simply hit the "sign in" button on their default Facebook account, they have probably reduced a significant amount of bad behaviour on their network.
The fact is the vast majority of people are already connected to Facebook under their real names on their mobile device at all times. Taking advantage of that (minimum security through "ease of use") is a good idea.
The person who goes to the store and uses a fake Facebook account to use their free WiFi maliciously is almost non-existent. People will just take the path of least resistance to get what they want now.
Stop thinking of their security in terms of how to circumvent it — that's easy — think of security in terms of which path most users will flow along. Then look at the tradeoffs of increased security to handle the remaining users, you generally find it's not worth bothering with them.