I see it, and I note that (a) that's editorializing by the WSJ based on their interpretation of comments from law professor Kate Klonick and (b) the underlying facts are that Facebook claimed XCheck is used in "a small number of decisions" and the evidence in that article doesn't contradict that claim.

Nothing in the article gives hard numbers, so (unless WSJ has those numbers and forgot to report them), we have to extrapolate. XCheck-flagged accounts grew to 5.8 million users, but Facebook has 1.9 billion daily actives. If we assume about equal numbers of issues from the XCheck and non-XCheck accounts, XCheck accounts would make up less than 0.5% of all incidents. That's "a small number" if you're thinking in ratios. If you're thinking in absolute numbers, well, we don't have enough data to know what the absolute count looks like. Could be that a lot of XCheck'd accounts have zero incidents. Insufficient data.