But I presume they don't have the users' passwords to login with.
I have looked around on Facebook and it looks like one can see other users friend list, even if you are not in their immediate network.
Even if Facebook has a limitation, like you can only see the friend list of friends of friends the company behind this app could probably make some fake Facebook users and befriends someone on each university to get an ok coverage.
I'd argue that this is another case which shows that the privacy scaremongering isn't scaremongering, but the privacy issues are real.
For me, half of the Facebook's utility was the ability to check people out without having to commit to a relation with them first. A publishing platform, a little bit like personal pages of old, but much more streamlined and accessible to the mainstream. But it turned out there's enough bad actors around (stalkers, marketers) that people voted against this, and so Facebook is now a very locked down place. I think most of those fears people have are overblown, but well, that's only my opinion and it seems that most people disagree.