Mailto: phishing prompts you to send an email because someone just logged into your account from an unrecognized device, and Facebook wants to verify it’s really you.

Mailto: links may evade email filters more easily than links to malicious domains, and threat actors don't have to set up and maintain multiple sites that may be shut down.