You are assuming these same people, with everything to gain through just this behavior, have been utterly and scrupulously well-behaved this entire time all while nobody really questioned them.

'If you authorized any app'? I'm sure there are workarounds for that. If you touch them or pages where their invisible Facebook gif is present, they've probably got all your data that's gettable.