A quick point I’d make is that it may not be a mistake (from facebooks perspective) to allow others to exploit a given system as long as they’re gaining enough value from it to outweigh that. If whatever is being exploited doubles how much they can charge for ads, they might accept some of their data being stolen until they could find a way to have their cake and eat it too.