The lack of fine-grained permissions per app is Android's fault, not Facebook's (not that they aren't benefiting).
Android application manifests means that if even just one user of your app might want to use a feature that requires elevated permissions, your entire app must be given these permissions for all users at installation time.
Which is obviously a huge security issue. What if I want to use the Facebook app but deny it permission to my address book? Not possible out of the box.
E.g. There's a feature to see if any of your phone contacts already have Facebook accounts. To service the potential people that wants this feature to work so they can easily "friend" these people on Facebook, the app must have this permission for everyone who installs it.