You misunderstand what happened. 1) Users installed a quiz app, 2) Users explicitly accepted a permission dialog that included "information about your friends", 3) The quiz app saved this data, 4) Cambridge Analytica bought the app (and data).

If CA got your data, it's because one of your friends sanctioned the critical link in this chain.

Facebook at least provided this level of security, however illusory it may have been. In a decentralized system, anyone who touches a piece of data can pass it on to whoever they want. There is no way to enforce "my friends can look at my data but it's my data and they aren't allowed to pass it on".

Privacy advocates and decentralization advocates are mortal enemies; their only common cause is that it's popular to hate on Facebook these days.