I lead Security and Privacy Engineering at Facebook and wanted to chime in on this thread.

As soon as we found the vulnerability, our first priority was to determine how we could protect people most effectively. If we had closed the vulnerability immediately, the attackers could have escalated their attack to modify information or post as someone else by using the access tokens they had already acquired before we reset them. Instead, we determined all the potentially affected accounts and reset their access tokens in a coordinated way to prevent further misuse of the vulnerability.

We haven't reset 90M accounts all at once before. Identifying the attackers, defining our remediation, validating that it would work, and closing the vulnerability while simultaneously ensuring all accounts were secure is complex to do at scale.