1. This has been a thing for quite a while now, there have been numerous articles about this. This is nothing new, although it may have not rolled out to all users.

2. Facebook gives explanation of all the permissions they need, including read SMS one, here: https://www.facebook.com/help/210676372433246

3. This is more android permission issue than specifically Facebook app one. Facebook, in order to implement automatic confirmation, didn't really have a choice.

And fwiw, I use the app daily and I've had this update for at least a month and the read sms permission was never used according to various privacy tools which allow you to see, disable and view usage history of app permissions.

Until facebook starts abusing this feature/permission I don't think it's really an issue like most articles about this make it look like.