Sorry, but it's a very poor sensationalist article
I wouldn't normally defend Facebook and I don't run the app.
BUT "superuser" is a feature *only* on rooted android phones. Facebook pointed this out in their response, why couldn't el reg?
Could the user just decline the permission? There's no claim that the app stopped working if the user did?
If you root your phone you're taking bigger risks than your Facebook data. You should understand what you're doing (obviously some don't). You changed a fundamental feature of the OS and voided any warranty. Why expect app developers to test on rooted devices anyway?
You don't even need root to install a modded OS like lineage, just an unlocked bootloader.