Main issue with CA wasn’t that it got data of users of an app - people have explicitly gave consent for it. They scraped data of your friends, that shared this data with you, and made it a big deal. Users explicitly granted access to data, but their friends didn’t. If you have an open API between networks, how is that different?

User A uses app X and shares data with user B. User B uses app Y. App Y is scraping data. They now have data of both user B (which expressed consent) and user A (which didn’t). It’s exactly like Cambridge Analitica.