>Is the only way to patch the app binary and reinstall the patched binary using a dev certificate?

Yes

>How exactly does one go about patching the binary – is there a tutorial somewhere?

https://www.guardsquare.com/en/blog/iOS-SSL-certificate-pinn...

Won't an app worth its salt use certificate pinning to prevent this mitm ? In other words - Can I use Charles to sniff FB or watsapp traffic ? I do not use both services, but interested in analyzing their traffic.

You'll see the attempted request (the fact that there was a request to a named server) but none of the request details, except the encrypted stream.

There are guides you can google for cracking apps and replacing the certs they compare against. IIRC they all require a jailbroken device.