This story looks like the exception, though?

The app piggybacking and the initial "View As" stories constituted Facebook handing out data sloppily. But location records, search history, and TFA-only phone numbers are internally held data Facebook wasn't showing to anyone. This moves things from "faulty visibility settings" and "shady data sales", which we've seen before, to "outright security breach".

Recent search history is accessible in the UI when you click on the search box. Assuming someone could see "what FB looks like from your perspective", they'd be able to access the last dozen-or-so searches.

I think you answered your own question. They wish to avoid responsibility.

Where does FB say it sells your data? Was there a news article about it?

I see this repeated about other tech companies as well but I can never find where they say they sell my data. It seems weird companies would sell their most valuable asset, rendering themselves moot.

My understanding is these companies allow advertisers to target users, but never sell the data.