No, Fb is doing the correct thing in this case. If I upload data to Fb, I expect Fb not to allow others to scrape it. I gave pictures/info to Fb, not to you because you had a browser extension installed.
However, your principle argument that there's a difference between Facebook serving pictures to friends and massive, automated serving of pictures to bots and scrapers. I understand that there's no good way to differentiate, and that the bits that are sent over the network are the same regardless of who is consuming them, and that my friends have the technical capability to upload the images elsewhere.
But just as you get different outcomes between one situation with an individual policeman watching traffic, pulling over reckless vehicles or tailing a suspect vehicle with a known license plate and another compared to a network of automated license-plate readers and speed cameras tracking the city-wide movement of lawful and criminal people alike, you get different outcomes when you differentiate between bots and live users.
Personally I don't think access should be given based on assumption of the query's intention (daily browsing vs scraping data for analysis authorized by someone), but like r/w/x and user group, i.e. if you can view, then you can view and record. Otherwise either no access granted, or burn after read.