The BSD license says nothing about patents, so this project is in some sense safer than a "normal" BSD-licensed project (but not an Apache, EPL or GPLv3-licensed project). The grant Facebook is giving you is fairly minimal but that's understandable from their perspective: they don't want to give you any extra patent rights, just enough to use the stuff they're actually trying to release.
It's not safe to use software in a commercial project. Facebook might hold patents on any random library you're using. Companies that aren't Facebook might hold patents on any random library or on React. You could develop a library in-house in a clean room and it could still infringe someone else's patent. Patents really suck that way. But React is in no more danger than any other code you might use.
EDIT: no more danger than any other BSD-licensed code. It would be safer to use code that has a less revocable patent grant, such as that in the Apache License, EPL, or GPLv3.