I'd question illegality. In violation of agreements, perhaps. If there were any, and there wasn't a wink, wink type of understanding on what would be done.
In violation of agreements, definitely, if you believe Facebook's public statement. I think it would be risky for Facebook to lie about their developer policies but that doesn't mean it's impossible. I don't have time right now to dig through archive.org to find an old copy of those, unfortunately.
For a much better examination of legal aspects than I can provide, see https://www.lawfareblog.com/cambridge-analytica-facebook-deb.... Please keep in mind the sentence "I am leaving aside for now the potential claims under British and European law, but those add to this list considerably," which is rather important given the EU's more aggressive privacy regulations.
It's like SuperPAC coordination. Every election cycle there are countless obvious violations of SuperPAC coordination at all levels and parties but these are hardly ever investigated much less prosecuted.
I sort of don't care why the media firestorm is so bad, even if it's unfair, because it means we might see some action which will limit bad actors on all sides of the political spectrum.
I'd question illegality. In violation of agreements, perhaps. If there were any, and there wasn't a wink, wink type of understanding on what would be done.