Yes, if they knew about it and didn't do anything, then that's willful negligence.

They are not helping their image - the latest is a rejection of GDPR for non-European customers. Seriously? Way to demonstrate commitment to user data protection FB.

This level of arrogance is a precursor to strict regulations. They are practically asking for it at this point.