This isn’t the whole truth. Facebook doesn’t sell data, but Facebook’s Graph API combined with microtargeting ad groups allows third party applications that the user has authorized to gather and sell sensitive data to anyone they want. In many cases, the data does leave Facebook’s servers as soon as the action is taken.
You could argue this is the user’s own fault, but prior to Cambridge Analytica, there was very little public understanding of what “connecting” an app to Facebook really meant among the general population.
Also, just because Facebook doesn’t sell this data today does not mean they never will.