> In such a case, the user himself approves sharing his data on Facebook with the app.
Most users are non-technical and have no idea what this really means. To users it means “if you don’t approve you won’t be able to use this”, so they do. It’s like giving candy to someone who doesn’t understand nutritional facts — all they understand is it tastes good, not that it’s also bad for you. Facebook and other companies know and take advantage of this.
Also, it’s my understanding the Cambridge Analytica app also pulled data about friends of people who used it, so even if you hadn’t consented to the app you were still scraped. At the very least Facebook is at fault for having a system that allows personal information of non-consenting users to be taken by third-parties.