Understandable that any entity that bypasses their API/consent flows and collects a user's data would be a big no, regardless of what their intended use is.
However, your principle argument that there's a difference between Facebook serving pictures to friends and massive, automated serving of pictures to bots and scrapers. I understand that there's no good way to differentiate, and that the bits that are sent over the network are the same regardless of who is consuming them, and that my friends have the technical capability to upload the images elsewhere.
But just as you get different outcomes between one situation with an individual policeman watching traffic, pulling over reckless vehicles or tailing a suspect vehicle with a known license plate and another compared to a network of automated license-plate readers and speed cameras tracking the city-wide movement of lawful and criminal people alike, you get different outcomes when you differentiate between bots and live users.
Personally I don't think access should be given based on assumption of the query's intention (daily browsing vs scraping data for analysis authorized by someone), but like r/w/x and user group, i.e. if you can view, then you can view and record. Otherwise either no access granted, or burn after read.
Generally I agree and understand FB's position. But isn't all of the data from Ad Observer publicly available?
why they were targeted for the ad.
Haven't used FB in ages but I assume it's like "why am I seeing this" hint in youtube recommendations (which usually says "because you watched video x").