The typical approach is to keep the PII in the backups encrypted with a user-specific key which is stored separately and can be deleted without touching the backups. I'd expect Facebook to do the same, but who knows?
That's clever and interesting. What happens in the case there is a vulnerability with the encryption method? Say, an exploitable backdoor or general weakness is found. Or even quantum computing comes along and makes it crackable? I guess in any scenario, since the data is not actually deleted, just theoretically being able to access it would be a big liability to have, no?
All of those problems are extremely theoretical, and nothing ever posted on Facebook is private in any meaningful sense anyway.
>nothing ever posted on Facebook is private in any meaningful sense anyway
That's false.
Most of your facebook data is likely not considered, or was not treated as, PII so this unlikely to have been applied to all the extra data about you.