iOS is sandboxed so they can’t do anything outside of the context of that app. To use any APIs that would require a permission dialogue you have to make a request to get a handle on them which only happens after a user grants permission, you can’t just reach into these. This is baked into the OS. Apps like the ones you’re talking about already hoover up is much data as possible in this context.
iOS itself is actually really good at this and can be improved and hardened further, Apple wants you to believe it’s somehow their review process and strict distribution channel that makes this possible.
But beside that point, Facebook has been able to force side loading on Android for years and still distributes via the Play Store, so that’s probably at least some evidence that they believe that distribution channel to be worthwhile.
So the Facebook app (and Instagram, WhatsApp, and whatever else Facebook owns these days) would be able to collect as much data as the OS itself allows, without any kind of warnings before install.
It could potentially even use private APIs of some sort to bypass Apple's OS-level permissions dialogs and collect data without even asking the user first—it's unclear, at this point, to what extent Apple would be able to police this sort of behavior from motivated bad actors like Facebook when they're not being distributed through Apple's App Store.