Not sure, does facebook just assume that everyone connecting from behind a NAT is the same person?

That seems like it could go poorly, like if one person in a household had been buying a secret birthday present or an engagement ring or researching divorce lawyers and then the targeted ads were associated to everyone in the house.

The definitely assume it's the same person. I get advertising clearly targeted at other people on my internet connection (eg. ads for property in a certain suburb, when I don't even actively look at property while another family member does).

There's much more than IP adress that's used to track you. Companies like facebook use all the forms of browser storage, browser fingerprinting, etc.