I don't think they can make money off plain text passwords? They can only lose money from that, if it's discovered and they are fined and lose some users.

They can make money from contact lists, but IIUC the article said they didn't use the contact lists. Also, given that it only affected a couple million users (like 0.1% of their user base), the damage to their reputation would far outweigh any benefits of actually using those contact lists.

On the last item, the collection of email passwords, the only benefit would be if they actually use those passwords to get information, so the above point covers it.

Let me know if I'm missing something.

Storing plain text passwords doesn't make them money, but it negatively affects users, should those passwords be compromised. Though FB didn't prosper from the mistake, users potentially feel a cost, so the outcome is the same. Criminal negligence might not benefit the bad actor, but it's still a crime either way.