> The Research app requires that users install a custom root certificate, giving Facebook the ability to see users’ private messages, emails, web searches, and browsing activity.

Ouch. Yes that's really bad, even if it wasn't a violation of Apple's terms of service (it was, apparently).