Facebook could probably check periodically from a separate IP (secret-shopping, if you will) and pull the URLs that don't comply.

Of course, it'd probably turn into an arms race as malicious advertisers try to profile FB's bot behavior and properly redirect it.

That is to say, I agree with you, the problem is non-trivial.