CA used deceptive practices to collect user data, & downloaded personally identifiable information for u users and their friends without notification or consent, unlike NYU. Those are significant differences.
There's absolutely nothing stopping one of the NYU academics from selling the data they collect for their study to "Cambridge Analytica 2.0" in 12 months. If that happens, which FB would not be able to stop, this situation become identical to the CA scenario. There would be no significant differences.
One was explicitly installed by the user, the other was foisted upon the unwitting user.
So, maybe some significant differences, depending on your POV.