IIRC the issue with CA was that a friend could share my data without me knowing. It could have been data that I uploaded and not my friend (and maybe the friend didn't even know the existence of this data).

I remember Facebook permissions for Apps in the past were quite laxes. I wonder even if theren't were data accessible to apps that were not visible from the browser interface.