Looking at the Facebook Developer API documentation yesterday, I noticed a subtle change in the permissions that they give to developers without review on the graph API. Somewhere between March 21 and March 28th 2018 they removed unreviewed access to the user_friends permission.