Can’t really win here. If Facebook doesn’t have open APIs, it gets accused of being a walled garden and hoarding data. If it builds those APIs and lets third parties act with the same permissions as the authenticated user that gave permission to that third party, it gets Cambridge Analytica.
The changes I'm referring to are much later than the CA scandal.
In the last few years, they've locked third-party apps out of publishing to Facebook Groups, closed down the bug ticket system, and gave every indication of having abandoned any efforts at improving the ecosystem.