I think there are some pretty large differences in scale between "buying ads to target people with specific attributes and saving the situations where they interact with your ad" and "enabling any application to view all of the information about any friend who has connected with the app user".

I wouldn't argue that micro-targeting can't end up with very specific privacy concerns, but I don't think it's nearly the same scale as "you should probably assume that if you signed up to enable the Graph API on Facebook all information about you prior to 2015 is available to people you probably don't trust".