On a similar topic, how does the facebook app on android suggest me pictures taken with the camera on the phone, when neither it nor any of the facebook infrastructure apps have any permissions on accessing local media?
What version of the app and Android are you running? I'm on Android 8.0 and just double checked, the second I turn off the storage permission, Facebook can no longer suggest or access any images on my device.
If you're talking about the VPN, you have to explicitly turn it on, and the first time you do so Android asks you for permission to let it "monitor network traffic" (actual quote from the dialog).