Even though Facebook protected employees, it failed to fix the vulnerability or to protect most users, a court filing charges.