If the user says Facebook can't track, I assume that what Apple libraries do is not give the app the IDFA. If Facebook tried to find a way around that, they'd be violating their agreement and their app would be removed.

Facebook could try to bypass the ask, but again, that would violate the agreement. Apple could also make it so that if you don't ask, you can't get thev IDFA. That's how I'd code it.