It was a breach followed by business motivated poor handling of the breach. Facebook learned about the TOS violation, requested that CA delete the data, and did

It was a breach followed by business motivated poor handling of the breach. Facebook learned about the TOS violation, requested that CA delete the data, and did not follow up with verification that it was indeed deleted. The fail to follow up is compounded by the fact that: a) Facebook was notified that CA did not delete the data; and b) The CA-held profiles were used to target politically motivated advertising on Facebook. One can't avoid linking the two facts. Facebook has no incentive to aggressively protect its user data when it hurts ad spending on the platform.