They're complicit, for sure. I'm not defending them.
I do however feel that Facebook are taking the brunt for what's happened and the finger should be pointed much more firmly at SCL and CA. Yes, Facebook should be making sure user data is a lot more secure and yes they should have intervened when they saw what was happening but let's not forget they weren't in cahoots with SCL/CA, not that we've seen as of yet, they were exploited by them and subsequently tried to make it go away as quietly as possible.
Are they arseholes? Clearly, should they take the brunt of the blame and public derision for what's happened? In my opinion no.
The issue is, Facebook seemed complicit with CA during the whole debacle. For example, you look at the data breach which happened in 2015 in which the Russian professor stole data of 50 million Facebook users. Facebook knew about this breach but chose not to go public about it. Then the Russian ads which ran on Facebook during the US presidential elections in 2016. Again, they were quiet about it during the elections and immediately after. After pressure from the media and general public, they yielded and admitted that they did indeed allowed Russian political ads to run on Facebook which might have influenced the vote.
Each time there's been a major controversy, Facebook has decided to appear ignorant instead of admitting its share of blame. My worry is, they've so far admitted to breaches which have been made public. Difficult to believe these two are the only cases where Facebook has influenced elections.