It wasn’t an exploit, but it was data scraping via the API. That’s why the API is so locked down now - for example, you can’t create a third-party FB app any more.

How do you think they monetize your data in the first place?

It’s all ads. No data is sold. It’s not the data that’s monetized; it’s your attention.