I can't speak for him. I can only speak for myself, and I'd think twice and at least attempt to reproduce it independently and submit it to Facebook and wait to hear back that they won't fix it and try to understand why they won't fix it all before deciding to post this kind of find to the wild.

I passed this to their oncall sec

Question, was this a "someone invited you" email with a join button? Was it an RSVP reminder of an event? A confirmed email? Subject line would be useful.

From: Facebook <[email protected]> Subject: Event Invitation {string}

Body starts with:

{my friends' friend} invited you to {page}'s event

There's no Join button, but there is a set of Going / Interested / Not Interested buttons in the standard Facebook styling. It's a calendar invitation.