I guess it depends on whether you view this as a continuum or have an absolute "...

I guess it depends on whether you view this as a continuum or have an absolute "anything the user touched is user data" take. Compare it to a couple of security issues they had last year:

First, the one where the attackers would have had full access to the accounts. Photos, posts, private messages, likes, contacts, etc: https://newsroom.fb.com/news/2018/09/security-update/

Or the one where some apps could read photos that they were not given access to, or in some cases that the user hadn't shared at all: https://developers.facebook.com/blog/post/2018/12/14/notifyi...