what provider? Facebook never sends it in query string. It can also be available for Man In The Middle, in server side logs etc. Hash is supposed to be more secure.
If there were a mitm they could get it even if it's in the hash. It has to travel to the client at some point.
of course it's visible in server-2-server, but not client-server