On the one hand, yeah, Apple has the ability to disable code running on your device.
On the other hand, Facebook was distributing and paying people to run literal _malware_ on their phones, using an exploit that bypassed all of the iOS's security features. It's incumbent on Apple being able to shut that sort of thing down.
You can't have one without having the other.