The scandal in Cambridge Analytica was roughly that they were able do this stuff after FB made it officially against the rules.

"able" is bearing a lot of load.

FB never built technical countermeasures, merely asked app devs to pinky-swear not to siphon user data.

This type of FB app was gone long before the CA scandal broke. There were some really cool ones available, but plainly not worth the tradeoff in retrospect.

A person associated with Cambridge Analytica used a researcher access and shared the data with the company (which he wasn't supposed to do). Researchers have (had?) more access than developers do.

Not true, they didn't have any special research access. There was an app called "This is your digital life" that was just a personality quiz that they used to scrape data. At this point facebook would let you access data about a users friends in detail when the user would authorize it (via these apps).

Also facebook killed this long before the Cambridge Analytics scandal broke. It also enabled some really cool features like their graph search where you could run queries like "people in X town that like football", but it also let you run very creepy queries to stalk people, which is why it got canned.