We literally have wireshark and similar utilities available to all of us to inspect every packet of data coming in to and leaving our phones. You can install pcapdroid right now to see exactly what facebook is doing and where that data is going. This is not complicated stuff.
Now imagine the payday and notoriety that’ll go to the security research firm that is doing this kind of work on a regular basis and is able to definitively prove it’s happening. Why do you think that hasn’t happened yet?