The point in the case is that Meta kept a detailed profile of the individual, and then processed that data, even though the person didn't have an account with the company.

That's against the EU's data processing and consent laws, irrespective of the actions of the third party app.