And we're surprised by this?? Its Meta after all. The social graph data we had access to in the social games we built back in 2009/2010 was literally insane by todays standards of security. They've just gotten better at hiding it.
Post-Cambridge Analytica, yeah, a smidge surprised.