Facebook on Android has been my nemesis for privacy violations. I created an account on Facebook, due to a couple of ham radio devices I have that have NO support on the web, except ONLY on a Facebook group ("How did we get to this?" I wonder). I locked Facebook down pretty thoroughly, disallowing any followers, etc., and when asked, DENIED it access to my contacts.
So, guess what it kept doing? That's right, it kept showing me possible friends FROM MY CONTACTS that I might like to follow. So much for saying no. Facebook just ignored my preferences.
This was on a previous Android release, before the OS starting asking you about app permissions. Also, on those previous Samsung phones, Facebook was in the ROM, so it couldn't be deleted!
Since moving to more recent releases, I've denied access at the OS level to my contacts, etc., and I've yet to see Facebook ask me recently for permission to hook up with any of my contacts. Not like they don't keep trying, though, I bet.