3+ years ago, their Graph API provided much more information than it does today. App developers (CA, in this case) used that open API to get information about the app user's friends, and then stored that data on their own servers (which is and always was against Facebook's Terms of Service).
>>>(which is and always was against Facebook's Terms of Service)
Nobody reads TOS.
Car analogy: leaving you car in a bad neighborhood, unlocked, key in the ignition, door open, with a "do not steal or we will send you a threatening letter demanding our car back" note.
To the GP's point, the fact that Facebook has stated recently that it will reduce the information provided to third party apps shows that there was still a bigger leak than it cared to admit all along.
