A long URL is essentially an authentication check. It's long/complex enough it can't be guessed, same as an auth token in your cookie. I'm not sure what guarantees they have regarding changing access, deleting images, etc but those would be the trade-offs. The advantage is the CDN doesn't have to perform auth checks which speeds up response times.

That said, I was under the impression Facebook's CDNs did support auth checks from cookies, such that passing URLs around didn't bypass this. So I kinda doubt the claim.