In the latest in its long string of 2018 incidents, Facebook let developers access the private photos of millions of users.