That's just one type of malware - spyware is also malware.

The only difference between a malicious app exfilitrating your cookies through an exploit and Meta exfilitrating your cookies through an exploit is you trust Meta won't use your cookies to impersonate you, steal your browser sessions, drain your bank account, etc.

But that's just pure trust. Meta could easily have a leak - Experian had a leak and people lost millions of dollars.