Did FB ever take any legal action against Cambridge Analytica? I can't remember anything about it and this sounds very similar to that (although back in those days FB's tools made this incredibly easy).

I wish the Cambridge Analytica FUD would stop. CA's "attack" was to setup a malicious website that convinced idiots to give it access to their Facebook account using the standard oAuth2 flow.

Did they misuse the collected data? Sure. But people granted access to that data knowingly. This wasn't really an attack in my view.

Facebook wasn’t really complicit and definitely didn’t sell/give away any data.