I agree. It’s technically impossible for them to get this data without OS-brokered consent. Apple’s app store privacy card is extremely misleading here, it is based on a self-assessment not what APIs the app accesses. It looks to me like Meta simply checked every box in the self assessment form.