> selling it to developers

FB doesn't sell access to their API. Many other businesses sell access to their API. FB doesn't.

> Also to say that Cambridge Analytica abused the system sidesteps the issue of whether it was in Facebook's interest to allow this data to be collected and then misused.

It absolutely wasn't in FB's interest as this media firestorm indicates. Also, CA purchased data illegitimately from someone other than FB. FB did not sell your data to CA or anyone else. (FB does sell advertisements, and those ads can be targeted to specific types of users.)

> Despite new restrictions how much about me is already out there? That's what I want to know.

FB is coming out soon with a feature that will let you see if CA had access to your profile.