Facebook (probably) has logs of data access, i. e. the API calls third parties have made.

But, unless there are any security bugs in Facebook's code being exploited, each and every API call is legitimate, prima facie.

The issue with Cambridge Analytica, for example, was with unauthorised retention and sharing of data, as well as its use for purposes not covered by the API access agreement. These circumstances cannot be detected from the logged data alone.

Mechanistically, the media discovered it because this newsroom was working more effectively than the team at Facebook auditing the corp to find similar breaches.

If you want another take on the “why,” consider the incentives of the two parties. One organization gains face by finding more breaches, one loses it.

What many experienced journalists have learned, just because someone records and store data, doesn’t mean they actively query and audit it.