> it's sending us traffic with fbclids in the mix. No idea why.

The click IDs are likely to make the traffic look more like a human who has clicked a link rather than a bot? That way it gets past simple filters that explicitly let such requests in before bothering to check that the source address of the request seems to be a DC rather than a residential IP.

> citing the competitive environment

All the companies are competing to be the biggest inconvenience to everyone else while scraping as much stuff as they can.

> The click IDs are likely to make the traffic look more like a human who has clicked a link rather than a bot?

It's certainly possible. However, the traffic is still coming from Facebook's network with a FB proxy PTR record in DNS. Seems much more likely to fool your typical site owner than a bad actor.