Seems like Meta is not regulating well those ads spreading on their platform since we could see phising sites and now that worse posted by OP which is malwares which can compromise lots of people.
I'm surprised Facebook is still around tbh. I no longer use them after I stopped needing to use my social media for my job. I thought Twitter replaced them. Judging from what I've seen in my circles, it sounds like they still have significant users. I remember reading that they advertised banned services in my country too, which can be another proof to argue that they probably don't filter their ads that well.
As long as users understand the basic common sense to verify apk before they install them, or always download from legitimate websites, this attack should be avoidable in most cases.