The problem is not necessarily the (bad) intent. The problem is amassing data without a clear and well defined purpose. And "just in case we'll use it in the future" or "we might need it" is not one. And collecting more than what you need does meet the definition of without a well defined purpose in this sense. I think this is also in line with the ideas behind GDPR.

From the point where your data is stored it's there for good. I think that's what they have proven, also, anecdotally, a googler friend told me well over a decade ago that they don't ever delete data. Which is not that surprising, since I, as a nimble private person, don't do either. So your data is there and it's there basically forever, you don't know what that data is and how that will be used in the future. Either by criminals who steal it or by the company changing policies or even the law being changed.

So I would say that even without bad intents, which I'm ready to believe not being there at the moment, collecting as much as you can and trying to filter out whatever someone thought of as being too sensitive is the exact wrong strategy. They should actively filter out everything except what they want to store specifically and they should claim what that is.

Other than that, I think completely blocking FB (and other big 3rd party) tracking is the way to go. It should be there by default in all browsers. There reason it's not likely to happen, is of course, that the most used browsers are all subsidized by the very companies that live off of data collection.