What do you mean by...
"adds apps to profiles"? They have to ask permission if they want to add a tab to your profile, access your personal details, photos, friends, etc. They only thing they can do without it (and, I think, what you're talking about) is be added to the list of apps you use.
Malware is a giant pain in the arse, no doubt about it, but this has nothing to do with what Facebook does and doesn't let you do- you don't need any access to a user's profile to show them a dodgy link.


