The app was allowed to scrape friend data as well, meaning that many more people’s information got exposed. That is on facebook.
Does it mean "friends lists", or "the data of the app user's friends profiles"? And in that second case, "the data of the app user's friends visible to the app user", or "as much data as if the friends had installed the app themselves"?
Unless it's that final situation, it's exactly how I assumed Facebook scraping worked already.