I mean, I can see a case for not wanting to play dragnet at a mere request. You don't want any random guy and/or agency to be able to have you to help them track down someone they only have a picture of, no matter how much they pinkie swear they're doing it to protect that person.

That's getting awfully close to sharing PII. You generally want to see a subpoena for this stuff and with good reason. Meta are, oddly enough, not being actively scummy here. (One can of course argue about all the other times when they don't give a shit; the bigger picture is definitely super scummy. But for this in isolation they actually have a valid reason for their behavior.)

What might work would be a standardized, streamlined process where the police can ask the company and if the company says the request is reasonable they can apply for an expedited subpoena to allow legal access to the information. Agreement by both would be necessary to give more opportunities for due diligence. This process would also have to have a very limited scope in order to make abuse harder.