That’s an oversimplification. The Facebook API had a gaping hole in it that allowed third party apps to access data on the authorized user AND friends.

Facebook discovers these kind of issues on a regular basis. The idea that they’ve clamped down on this type of thing is the joke of 2019.