Did they just give all the data to Cambridge Analytica for free?

The Facebook Graph API is free, yes. Cambridge Analytica happened because the API was too open and allowed loading some profile data for not just you but your friends too. The idea was that social apps like Spotify could show your FB friends (and in fact Spotify was one of the early major users of the API), but of course some people figured out how to use it for evil.

The API is now very locked down as a result, and requires a lot of certification and approval to use anything even remotely sensitive. Developers don't like that since you can't easily write scripts/bots for FB any more like you can on Discord for example, but there's not really any other option. Other apps like Discord will likely hit similar issues if they grow anywhere near the size of Facebook.

I include their advertising targeting in my data being sold, even if they retain the data in house,

Saying that data is sold implies that another entity is buying the data, which isn't true. You could say that your data is being monetized, sure, but not sold.