My email client has full access to the contents of my email but the author of said client has none. Although my client has credentials these are stored locally and like my email never communicated to the creator of my client.

If the device makers applications merely fetched data on behalf of users and displayed it on their machine it would be no more of a problem than my email client.

In the first place it looks the apis provided access to data the users had opted not to share in the second place the times article seems to state that partners partook of that data themselves rather than merely acting as a client example

"Facebook acknowledged that some partners did store users’ data — including friends’ data — on their own servers. A Facebook official said that regardless of where the data was kept, it was governed by strict agreements between the companies."

Before deciding if facebook's response was reasonable did you even bother reading the times article?