Misleading privacy controls, privacy-negligent API, FB Beacon... these FB features date back quite a few years, and were terrible for users. That is the sense in which I say it's bad design.
If I make a pizza with tasty, fresh ingredients - but then top it off with rotten fish guts and mouse turds – it's a garbage pizza.
None of those are the product. Once again, the product is the experience using the website. Those are implementation details that only weird nerds like you and I are concerned about 99% of the time. The privacy loss that most end users (or former end users) are worried about is their parents/spouse/employers being on facebook. These are not things facebook built, but consequences of the social graph changing.
And those "features" are all fine in a world where the internet is mostly young twenty-somethings with no power, as the internet was in the early-mid 2000s. Also for a product where you can just put in a fake name, as we could back in the day.
I closed my FB account in 2011 specifically because the design of the site abused its users in countless outrageous ways (come to think of it: "Are you sure you want to close your account? [These friends] will miss you").
I really don't see us coming to any agreement. It's been fifteen years and, while FB has pumped out plenty of LoC, FB has never shown an iota of respect for its users. No surprise then that the brand is dirt, and Zuckerberg has to spin fairytales about how its 'metaverse' will stem the decline. Their ability to execute is not the problem; the demographics of their user base is not the problem; the product itself is the problem.
If I make a pizza with tasty, fresh ingredients - but then top it off with rotten fish guts and mouse turds – it's a garbage pizza.