They can sue you for using React if they have patents that it infringes. That's kind of the whole point of the patent grant, to allow you license to those patents to cover your usage of React.
A common understanding of the BSD license is that it has an implicit patent grant, but the existence of the explicit patent grant presumably negates the implicit one, meaning if you lose your explicit patent grant (e.g. by suing Facebook when they infringe one of your patents), then you have no protection from Facebook suing you over your usage of React.
A common understanding of the BSD license is that it has an implicit patent grant, but the existence of the explicit patent grant presumably negates the implicit one, meaning if you lose your explicit patent grant (e.g. by suing Facebook when they infringe one of your patents), then you have no protection from Facebook suing you over your usage of React.