The requests are authorized, by authenticated users. Facebook could just deny the requests or rate limit. Or stop offering the unfollow feature (which they keep moving and hiding).
If a company offers a service to the general public, you are allowed to use that service for any purpose permitted by applicable law. Even if the EULA / ToS says you can't. It says so in the applicable law.
Just because a company offers a service doesn't give you the right to (ab)use it any way you want.
If that were the case hacking would be considered legal.