Re: Sorry, but it's a very poor sensationalist article
BUT "superuser" is a feature *only* on rooted android phones. Facebook pointed this out in their response, why couldn't el reg?
Which is exactly why this is a Hanlon Razor case - do not seek malice where stupidity will suffice.
F***book has a RIDICULOUS permission list on a normal phone. It asks for nearly everything. Here is the list after purging duplicates resulting from permission name changes across Android versions (make sure you are sitting comfortably and do not fall off your chair):
This app has access to:
Device & app history: retrieve running apps
Identity: find accounts on the device, add or remove accounts. read your own contact card
Calendar: read calendar events plus confidential information, add or modify calendar events and send email to guests without owners' knowledge
Contacts: find accounts on the device, read your contacts, modify your contacts
Location: approximate location (network-based), precise location (GPS and network-based)
SMS: read your text messages (SMS or MMS)
Phone: read phone status and identity
Photos / Media / Files: read the contents of your USB storage, modify or delete the contents of your USB storage
Storage: read the contents of your USB storage, modify or delete the contents of your USB storage
Camera:take pictures and videos
Microphone: record audio
Wi-Fi connection information: view Wi-Fi connections
Device ID & call information: read phone status and identity
Phone: directly call phone numbers, read phone status and identity
Phone: read call log, read phone status and identity, write call log
Identity: find accounts on the device
Contacts: find accounts on the device
Identity: find accounts on the device, add or remove accounts
Other: download files without notification, receive data from Internet, adjust your wallpaper size, view network connections, create accounts and set passwords, read battery statistics, pair with Bluetooth devices, access Bluetooth settings, send sticky broadcast, change network connectivity, connect and disconnect from Wi-Fi, full network access, change your audio settings, read sync settings, run at startup, draw over other apps, control vibration, prevent device from sleeping, modify system settings, toggle sync on and off, install shortcuts, read Google service configuration,
change network connectivity, reorder running apps, set wallpaper
I believe that this is all permissions known to Android +/- one or two. So someone in their development team got lazy and decided that "if I am on a rooted phone I might as well just ask for everything at once".