Facebook published an API for third party apps to access data with user consent, and Cambridge Analytica used it. The outrage indicates that a belief that there should not have been such an API. Or at least that users were not competent to consent and that Facebook should have been controlling which 3rd parties they could share with.