Every time someone argues that people can avoid the privacy problems of Facebook by simply not using it, I point out this issue (plus the shadow accounts).

I recently purchased a phone that had the Facebook app preinstalled. If I had to guess, the mere act of connecting to WiFi caused a whole slew of info to get sent.

I would think not, but my cluefulness regarding Android security/privacy is effectively nil.

Actually Android devices (especially older ones) are known for in many cases sending extensive data to the manufacturer on network connect. See for example: https://www.nytimes.com/2016/11/16/us/politics/china-phones-..., https://balagetech.com/android-app-phones-home-china/

I didn’t check what permissions it was given by default but hopefully not too many and with those not much spying. It would be nice to have a clear map of what data can be obtained with what permissions.

Obligatory mention: mbasic.facebook.com it's like a clean needle exchange for Facebook.

That's nice. I deleted my fb but sometimes groups will require it for events and discussion boards.

There was a dark phase when it looked as if the only way to sign up for various services was going to be Facebook. If memory serves, there was a time when Spotify sign up required Facebook.

The difference between malware and "legitimate" software is whether there's a "legitimate" company behind it and whether that company has a "legitimate" interest in the information. Sad but that's how it is. Just like how governments give themselves the right to crack computer security and surveil everyone but throw citizens in jail if they do the same thing.