You misunderstand what happened. 1) Users installed a quiz app, 2) Users explicitly accepted a permission dialog that included "information about your friends", 3) The quiz app saved this data, 4) Cambridge Analytica bought the app (and data).
If CA got your data, it's because one of your friends sanctioned the critical link in this chain.
Facebook at least provided this level of security, however illusory it may have been. In a decentralized system, anyone who touches a piece of data can pass it on to whoever they want. There is no way to enforce "my friends can look at my data but it's my data and they aren't allowed to pass it on".
Privacy advocates and decentralization advocates are mortal enemies; their only common cause is that it's popular to hate on Facebook these days.
And CA “leak” was way more tame than this, just the information displayed on your profile for all of your friends.
I can see arguments both ways. Some folks would be ok with it (they're your friends) and others wouldn't (you can't change the privacy setting on data that's already been downloaded).
Similarly with friends list. A person's list of friends is probably "their" data, even if it has your name on it. Would you be ok with them downloading this information?
The trade-off between control of some users and the privacy of other users is a complex issue. Let's not pretend there are simple answers to this.