A case could be made that it is quite responsible to let people know how they can control the permissions that they grant an app.

yes. in fact any scope is opt-out-able. But not in UI of facebook. Only in URL. I just tell people how to manage them

this has nothing to do with CSRF btw. And this is not flaw of FB - this is a core flaw of OAuth2. Lots of them though:

http://homakov.blogspot.com/2012/07/saferweb-most-common-oau...

http://homakov.blogspot.com/2012/08/oauth2-one-accesstoken-t...