The Facebook Home app doesn't really do much itself. It gets all its data from the main Facebook app, so it doesn't need to access the Internet. Doing any action from the launcher uses an intent to launch the main Facebook app, so it doesn't need to (say) access your location or take photos to make posts: only the main Facebook app does.
To take another example, say you use Facebook Home to "like" something. Facebook Home doesn't go to Facebook's servers: it tells the main Facebook app (on your phone, so not using the Internet) to "like" the thing. Then the main Facebook app (which does have the Internet permission) uses the Internet to tell Facebook's servers about the "like".
The same goes for the size. All the Facebook functionality, sync code, custom button graphics, libraries, and so on are in the main Facebook app, so why would they duplicate them in Facebook Home? Facebook Home probably just has a little code for laying out the home screen, a few icons, and the information Android needs to understand that the app is a launcher.
The apps can use each other this way because they're both by the same developer. (Actually there's a little more to it than that, but that's the first requirement.) Android verifies this by looking at the signatures on each app to check they were both signed with the same private key: in this case, a key that Facebook (the company) has. Without this private key, another developer can't create another app (or modify this app) that can use the Facebook app like this.
It's also possible for an app to create a new type of permission. So, as an example, the main Facebook app could create a "read my Facebook timeline" permission, and then I could write an app Dan's Bookface, which would be able to request that permission in order to read the timeline directly from the Facebook app, without needing the "internet" permission. When you install Dan's Bookface, you'd see "read my Facebook timeline" in the list of permissions just like you do with the permissions built into the system.