It's not just advertisers that are the issue, but third-party developers. Cambridge Analytica (and many others like it) got all of that data as a third-party developer, not as an advertiser.