I.e. apps added to a group by an admin could get some metadata about members of the group.
(That blog post would also have been harder to mis-interpret than the NBC article. Half the early comments seem to think that this was about Facebook engineers improperly accessing data.)
I don't know what goes into running this site, but personally, if I know I'm guaranteed to get a totally one-sided take, I'd rather have the one from the people who actually know how to code.
In other words, if you don't know how to code, you are probably not intelligent enough to write about a technical topic?
How would you know the difference?
At some point, you've got to let people decide for themselves what is true. A single source of information is an unreliable source.
First, the one where the attackers would have had full access to the accounts. Photos, posts, private messages, likes, contacts, etc: https://newsroom.fb.com/news/2018/09/security-update/
Or the one where some apps could read photos that they were not given access to, or in some cases that the user hadn't shared at all: https://developers.facebook.com/blog/post/2018/12/14/notifyi...