As someone that knows the person that originally tipped Apple off about the tracking... this is such a misinformed editorialization of what actually happened where I don't even know where to start.
Among other things: lots of other companies (including Google) were doing the same thing, wasn’t an app for general distribution (the kid had already had his parents permission for using said app), order of magnitude a thousand people ever installed the thing.
Enforcement from Apple on FB basically came the day after they were hit with an embarrassing “Hackers can turn on your camera without you knowing it FaceTime” bug. This part is hearsay, but, IIRC, Apple only started enforcing on the dozens of other companies that were doing the same thing once legal action was threatened for uneven enforcement. (Meanwhile, the kid that I chatted with that reported things to Apple in the first place... definitely reported more than just FB.)
From a factual perspective, it wasn't on the App Store. (It was distributed via an enterprise certificate, which I find to be even worse, since they are explicitly not supposed to be used in the manner that they were.)
Not going to comment on whether or not it was philosophically correct, but I will note that Google (not to mention dozens of other companies) were doing the exact same thing — just that they didn’t get called out for it until a few days after.
IMO, I wouldn’t be surprised if this happened this way cause Apple had decided to use FB as the fall for a PR media blitz. (In particular, Apple made the decision to “enforce on FB” basically the day after their “someone else can turn on your camera with FaceTime without you knowing” bug.)
