Thus you end up with 3rd party clients gaining access to data of others who never granted them explicit access (aka Cambridge Analytica) through friend connections.
That's the nature of social data (and it's already this way for email -- Google knows what you email @gmail.com addresses even if you don't have one).
I personally see nothing wrong with this. I didn't think Cambridge Analytica was a big deal either, just something the media blew out of proportion. If you communicate with people, what you send them will be available to whoever they share it with.