>To me, Facebooks’ entire business model seems like spyware and selling personal info to third parties.

"seems like" is doing a lot of the heavy lifting here. I'm not aware of instances where facebook was "selling personal info to third parties". It does use personal info to sell ads to third parties, but characterizing that as "selling personal info" is a stretch.

>We know those scammers use Facebook to gather info and target victims, all without any actual breach taking place.

This just sounds like "scammers are viewing public facebook profiles and using facebook messenger to communicate with victims", in that case I'm not sure how facebook deserves flak here.