Facebook definitely did something wrong. Facebook makes developers sign up to an agreement that states they won't pass the user's information on to other parties. Kogan did that and Facebook failed to stop him, and then failed again when they didn't follow up sufficiently with Cambridge Analytica. Putting in a framework to protect user's data and then failing to act on it means they failed to protect their users.

Kogan and Cambridge Analytica also did things that I would consider wrong, but that doesn't let FB off the hook.