As mwarkentin included, CA _did_ pay users via mechanical turk to install the quiz app. So they did pay the users directly for their data, but not facebook. It seems there is no way to completely stop this without facebook blocking people from exporting their own data. Since CA could just pay people to send them their exported facebook data.

My understanding is the "quiz app" was more of a phishing scheme to get users to share their Facebook data with Cambridge Analytica (including data that user had access to about their friends).