Now let’s assume you make a quiz which uses the list as answers, taking the quiz is just normal behavior, automating taking the quiz in order to extract the whole list is somewhere between hacking and scraping to me. It’s not “just scraping content” but it’s also not using a security exploit to gain unauthorized access, it’s abusing the systems intended functionality to expose content that was not intended to be published and then collecting it.

Obviously someone should’ve be able to get a Facebook account id just by providing a phone number in the first place, but if used as intended the feature is harmless, but if we want to claim this is “just scraping” then Facebook would also be claiming that the there was absolutely not issue in publishing a list of all user accounts and phone numbers in the first place.

They blame shifting on fb is really unacceptable.

It was really a spraying attack, which counts as "hacking".