No, it's known that Facebook did not take any meaningful action even after learning that this sort of data had been retained against their developer ToS, and was being used by the Trump campaign.

There are also enough stories from FarmVille and far smaller apps and the access they had. I wonder if anyone remembers running into API rate limits in the 2010-2012 timeframe?

I remember being as surprised by the API access as many of the testimonials we now hear. I had initially implemented rate limiting on my side. After never running into any problems, I gradually reduced the delays to 0 without ever hitting any limits. But I only ever accessed maybe a few dozen GB of data, not the 100+ million accounts others apparently got.

It may also have been important that CA saved all the data with no expiration policy. The API limits may have been set based on the usage pattern the ToS prescribed, namely never caching data for more than 24 hours. If you save and reuse the data instead, you save a lot of duplicate API calls and get new data instead.