App tracking permissions are handled by the OS, it's entirely possible to ship Facebook apps that can't track because they can use the same exact permission system that the existing Facebook iOS app is using.

You don't need the App Store for security, it isn't a dichotomy.