The Facebook iOS SDK only needs your bundle & app IDs of your iOS app to match those of your Facebook app.
If I find out an app's app ID, can't I just create another iOS app with that app's bundle ID? Sure, I may not be able to distribute my app on Apple's App Store (since it requires every bundle ID to be unique), but can't I distribute it other ways? Shouldn't the iOS app also need to know the app secret? I guess Facebook figures allowing an attack to extract the app secret from the iOS app would be worse? What about storing the app secret in the iOS SDK Keychain Services?