Yes it says so in the article. Users gave permission to access photos for one purpose and Meta abused it to access all photos for other purposes. They tried to weasel out of it by using a fine print "and other purposes" in the consent dialog, it didn't work.