At the end, this is all about business and reputational risk arising from the research data being misused ala Cambridge Analytica. Risks are quantifiable based

At the end, this is all about business and reputational risk arising from the research data being misused ala Cambridge Analytica. Risks are quantifiable based on past litigation history. So why can't FB require the researchers to provide indemnity secured by their college's fund or through some specialist insurer? If what they're doing is really above board and data collected is secure, the indemnity will never be called in and everyone can be happy.