A couple of my devices have Facebook in the stock bloatware; it can be disabled on a per-session basis, but it cannot be removed (without rooting).

Even though I have auto-update for apps disabled, the bloatware apps can update whenever they want, so it's typical that shortly after I power on a device, it will go through one or more update downloads and installs I can't prevent... even if I'm using a metered hotspot.