Not to defend Facebook for not doing their due diligence, but this article is really underselling the complexity of the problem. The pseudocode given:

if (display_domain == landing_page_domain) { approve_ad = true; }else{ approve_ad = false; }

is, for one thing, not robust against cloaking (if malicious advertisers see the request coming from a Facebook IP, they might actually redirect to the displayed domain).