1. Of course!
2. It's not too late to delete your account. Go for it!
3. Block it all! https://github.com/jmdugan/blocklists/blob/master/corporatio...
How do you know? If FB can't be trusted to actually delete your account (and they can't) how can they be trusted to stop collecting data on you?
In addition to the standard protections of the adblocker and privacybadger, I also generally set a full block on all content from facebook[.com/.net] and any identifiable facebook subdomains. I really have no use for facebook, so it is zero imposition on me, and if I ever want to view something on facebook, I can open up a new private window in an alternate browser as a one-off (or, if I'm feeling paranoid, spin up a VM).
Back in November I started getting Facebook spam on my Gmail account, the "people you might know" your emails, and there were people I knew. I clicked on an unsubscribe link that led me to a login. Out of interest I used my Gmail account and reset my password, and within thirty seconds I was back in my account. It was exactly the same account as I had permanently deleted.
My assumption is that someone screwed up at Facebook and ran a query that updated permanently deleted accounts. I'm not sure what else could have caused this to start so spontaneously after years of peace.