That's one of the two bullet points where I can see a reasonable case for Facebook's side. It's slightly muddied because the app is running on Facebook where they control it, but I can sort of see an argument for apps' actions conceptually being actions of the user running them.

I'm somewhat sympathetic to Facebook on the other app-related claim as well, "Facebook represented that third-party apps that users' installed would have access only to user information that they needed to operate." Yes, Facebook could've done better on that, but fine-grained security is something nearly nobody has solved.