If they built in proper data access controls, one would think that suspending apps would not be necessary. The fact that the apps have the power to grab people's personal data at all is the problem. Why don't they just shut down the leaky APIs, disable all the apps that require those APIs, and make the app devs update them? On the assumption of course that Facebook gives a single lick about actually protecting people's personal data.
They don't, that's the entire point. From the day they created the API it was with the understanding that people would farm the data. FB only asked politely that companies not collect so that they could tell the public what they are telling them now (We had no idea!), but no developer ever took that seriously.
Then they should get absolutely no praise or even acknowledgement for suspending these apps. They made the fence with no gate, saying they've kicked out a few of the foxes isn't praiseworthy.
Actually allowing access is not criminal provided they tell you they are going to do so in the TOS.
That's why we need a law to make it explicitly illegal to share any such information at all for commercial purposes. I don't really care if it destroys business models. Maybe some of those business models deserve to be destroyed.