Android 6 fixes this excessive need for permissions by mobile apps. You only grant permission at runtime and can withdraw it at anytime.

As far as I know, it's still tricky to install an app, then revoke all permissions before the app can possibly run? It would be different if no apps got any permissions by default, and they all had to "prompt on first use" - but that's not how it works, or is it?

When an app installs it has zero permissions. When the app needs privileged access like microphone access a system notification pops up saying "To record a voice message allow AppX microphone access". You can choose to grant the permission or ignore it.

That's how it works for apps targeting API 23 (Marshmallow).

Right, but the fb app targets much older APIs? And/or how would you know before installing?

I think it asks you when you install the app only if it targets an older API. Not certain though.

This is a problem with Android, not Facebook. iOS asks for permissions "on-demand", not when the app is installed. And everything can be denied and you can still use the app.

New Android apps do that too. Unfortunately older apps ask for all permissions from the start, but I assume they will deprecate that eventually.