Sure. There is perhaps a moral/ethical responsibility. But there are laws against sharing sensitive info and I don't think "I didn't know FB scripts did that" helps. FB's entire business is gobbling up user data. And pharmacies business is to know who they share sensitive data with. I don't think it's too much to ask to require siteowners to understand what the scripts they use are actually doing, at least if they deal with sensitive data.

For example, I don't think pharmacies should do any kind of advertising on FB, or do any kind of campaign tracking/conversion measuring etc on the same site they accept user data. As will all GDPR violations, if just a few large pharmacies were fined out of existence, I bet the rest would quickly fall in line.