Comment by saagarjha

Of course, there are ways around this: you could make a copy of Facebook that doesn’t pin certificates.