There is (or was) a “bug” in the business logic, as is now apparent. Assuming it is the case that CA gained access to this information by lying, it means there

There is (or was) a “bug” in the business logic, as is now apparent. Assuming it is the case that CA gained access to this information by lying, it means there were inadequate safeguards in who could access. The data. The only reason you could say this wasn’t a “breach” is because FB had engineered virtually no safeguards against this type of deceptive use of user data.