They were also caught a few years ago asking users to "verify their emails" by providing Facebook their email account password(2), after which FB's servers logged into the user's email account and scraped their contacts out without warning.
They also acquired a popular VPN app explicitly so they could comb through the users' traffic data and identify competing apps for acquisition.(3)
In my opinion it's core to how the company has always been. Facebook's predecessor, or perhaps first iteration, FaceMash, was a hot-or-not game based on student photos scraped from Harvard's internal websites(4).
[1] https://theoutline.com/post/4578/facebook-is-tracking-you-on...
[2] https://www.theverge.com/2019/4/18/18485089/facebook-email-p...
[3] https://techcrunch.com/2019/02/21/facebook-removes-onavo/
[4] https://www.thecrimson.com/article/2003/11/19/facemash-creat...