but actively reading your camera roll is next level.

Now that it was established that they wrote malware to bypass tracking protections, nothing surprises me. Apps written by Meta are malware, as far as I'm concerned.