Did they even agree to the ToS? It seems like they wrote their own plugin to harvest the data, what agreement did they made with Facebook that they are in violation of?
That's the key point here. The researchers are not a party to Facebook's terms of service. The user installing the add-on may be, but that does not bind the add-on developer. (This is called "privity" in law; contract constraints do not obligate third parties who didn't agree to the contract.)
Facebook could disconnect Facebook users using the add-on, if they can detect them. That would be a bad PR move.
Unless the researchers have their own personal FB accounts. You know, like 3.1 billion other people.
> In a letter sent Oct. 16 to the researchers behind the NYU Ad Observatory, Facebook said the project violates provisions in its terms of service that prohibit bulk data collection from its site.
Remember, one is presumed innocent/not liable until proven otherwise, not when you get a C&D (or get arrested, or get sued, for that matter).