I feel like this move by Facebook is opening up a ton of new opportunities for phishing scams.

There are a lot of people who won't carefully check the address bar when, upon clicking something on a website which looks like a Facebook plugin, they are asked for their Facebook login information.