They view themselves as an agent of their users. The users willingly give them data, with the intention of sharing it with a select audience. As the user's agent, one should generally abide by their wishes, and especially prevent the data from being shared further abroad than the user intended.

I’d argue most Facebook users do not know the difference between what FB does with their personal info and what this other organization does.

For those that installed the extension, one is Facebook, one gives free gift cards. Both are “okay.”

So I don’t see this as protecting users so much as ensuring no one else monetizes their data.

It's not about the user who installs the extension. It's about the user's friends.

Unless Facebook stopped creating shadow profiles of non-users (have they? I'm not a user and don't keep up with it) I don't think they have a leg to stand on.