If they don't have a button that says "share" that you click before it posts that's a TOS violation and will likely be changed quickly if the FB compliance team is paying attention.
Fact of the matter is that install rates often don't change much when you ask for additional permissions. Most users don't care. There's often no compelling reason to build out complicated permissions flows when the standard "ask for it all up front" works just fine.
Have a source for that information? Facebook's own API documentation page says: "There is a strong inverse correlation between the number of permissions your site requests and the number of users that will allow those permissions. The greater the number of permissions you ask for, the lower the number of users that will grant them; so we recommend that you only request the permissions you absolutely need for your site."
Fact of the matter is that install rates often don't change much when you ask for additional permissions. Most users don't care. There's often no compelling reason to build out complicated permissions flows when the standard "ask for it all up front" works just fine.