[sfashset]

CA didn't do any of those things. They purchased some data an academic had collected from a FB quiz app.

There's absolutely nothing stopping one of the NYU academics from selling the data they collect for their study to "Cambridge Analytica 2.0" in 12 months. If that happens, which FB would not be able to stop, this situation become identical to the CA scenario. There would be no significant differences.

[freeopinion]

I think it is significant that one happened server-side using FB tooling and the other happens client-side without FB being complicit.

One was explicitly installed by the user, the other was foisted upon the unwitting user.

So, maybe some significant differences, depending on your POV.