Meta connected its support chatbot directly to critical account management functions, giving attackers an easy way to hijack accounts without authorization.