I recall when I still had Facebook, many people would randomly add you and pretend to be random people, sometimes famous, sometimes they "just want to be friends". I know most people have some settings along the lines of "no one except friends can see all this data". This is an issue, because people will add these "friends" and forget about these permissions. These "friends" can easily be attackers like these that suddenly have access to all your data. Hence the "illusion".
With a phonebook on the other hand, when you opt out, you've opted out.
I’ve had FB since 2007. Don’t recall there ever being a surge.
Afterwards my friend's list hovered around 150. These were family, close friends, less close friends, and acquaintances. I also had hundreds on my friend requests lists by the time I deleted my FB around 2015.
What makes you think that that isn't the case here? It sounds like they just scraped all the public profiles they could find. It's not a database "leak" or something like that.