Literally anyone with a fist of dollars and minimal dev knowledge access can parse those leaked numbers, send mass text via API and damage facebook even more than they would damage themselves.
Actually, the processing of this data itself is probably a breach of GDPR.