Malware needn't exploit a vulnerability. There is much malware (e.g., Comet Cursor, Bonzi Buddy, etc.) that relies on being installed by the end user and may even present as a fun or useful program... but it's really doing something to your detriment behind the scenes.

If Bonzi Buddy counts as malware, so does the Facebook app.