If it's not obvious, that's total bullshit. You can set your blog to friends only and set privacy controls on pictures...yet the privacy controls are severely lacking when it comes to apps. There is no way in hell that the Cambridge Analytica scandal is the only case where users privacy was violated. Facebook didn't provide adequate protections for user's privacy and it was abused. I guarantee that there have been TONS more violations. It's just a matter of them being uncovered.

I imagine if a few reporters took the time to look into whether or not there were other companies that did similar, they would find many. That would likely not be good for Facebook.

But, the options for users isn't great. They have no option other than to agree to the TOS and Privacy Policy that Facebook sets forth, or not use Facebook, which for a long time was a monopoly. And then once there, if they chose to be active, there were many apps that they might be pushed to use by other user to figure out what character they were or whatever, each one of them being a possible data breach because Facebook did not properly guard their user information. There was no one minding the store. No one was checking if anyone was robbing it.