The sentence “only available on the device” makes no sense to me as an engineer. What?
Did Facebook code review every app and OS they gave this access to? Even then, would they be able to garauntee that an update couldn’t be made to the app or some library it relied on to prevent it from harvesting the data?
If that data was encrypted, how did it get displayed on a screen without being unencrypted first and this made vulnerable to scraping?
I was an iOS and Android applications developer and I can’t think of any way to do it (at least on iOS) short of (a) keeping it completely encrypted the entire time (b) only allowing an application signed by Facebook and belonging to Facebook and controlled by Facebook completely (in iOS, at least) to get this data since iOS apps are well sandboxed from one another or (c) relying vaguely on a legal agreement that the other party not be naughty with the data contractually which means jack shit to the Chinese.
On Android - Jesus, forget about it.