"Weird how Facebook keeps signing lucrative contracts with companies whose behavior then surprises and astounds them."

Another way to put this: perhaps the morally and legally culpable behavior is. . . Facebook's.

Facebook did not get any money for Cambridge Analytica's use of their API.

There was no contract between Facebook and Crimson Hexagon regarding data. All data mined was publicly available to anyone.