An event that trigged it for me: visiting break.com (after previously logging into facebook) resulted in a Break application being added without consent.
I think that is the rub here.. Somehow they are showing as "recently used" which is completely different from "Authorized". The app does not get a session key from you and has no additional permissions or access to your account.
The friends thing mentioned in the article has always been that way. Every connect site is an app, go to an app you can see friends who have installed it, as it always has