Leaving aside whether Facebook's app genuinely does this (which is a separate question), is this possible? I had always naively assumed that an app couldn't access what was on my clipboard unless I explicitly chose to "Paste" into a native text view. Is that assumption wrong? What is the security model for the content of the clipboard on the two major phone OSes? (Or what are the security models, if it's handled differently between iOS and Android?)
Yes, it's possible in Android. Any app/service can read your clipboard data. In fact, there is a lot of code online which creates a service running with a listener in the background, which will inform the app whenever the content on the clipboard changes, along with the content.
There are a few Android apps that I know which use this feature. One is Truecaller: whenever a contact number is copied, an on-screen overlay tells me the phone number's owner's name. Another one is Google Translate: whenever I copy a statement or two, I see a floating icon on my screen, which, upon clicking, gives me an option to translate the copied text to another language.
Here is an example from Stack Overflow for your reference.
As confirmed in the comments by user 11684, even Apple allows apps to read your clipboard (though only while they are in the foreground). Here is the link to the documentation that returns the data of the clipboard.
It is definitely possible for an app to check the clipboard content anytime.
Example: copy a link, then open Chrome. It will offer the link in the search bar (‘goto link you copied’). If you copy something that is not a link, it will not make that offer. This proves that it checks the clipboard without explicit user action.