Question about Facebook and Cambridge Analytica incident

For my understanding what happened is that a third party app that some users installed had gathered ONLY publically available data of those users and their friends.

So my question is did Facebook ever promised to its users that such thing can't ever happen? Like did FB ever promised to users that their public data won't be available to the world to see and possibly to be gathered by third party for some use?

Also for my understanding even if …

analytica cambridge facebook incident privacy