The GDPR is an extension of current data protection law, which has not been well enforced in the UK. The problem with the evil that is FB is that when you sign up to it you agree to its terms and conditions, which basically give away all rights to your data. FB has put in place its biggest ever project team to deal with GDPR and still hasn't managed to become compliant, which leads me to think it is breaking the current law. I'm not sure if there are any other privacy geeks on here, but FB has just been hauled into court in Belgium for its dodgy practices - FB of course says Belgium has no jurisdiction over it and this is an important area that will change with the GDPR.
As I refuse to go onto any FB site I don't know what exactly it says about signing into other sites through its app, but it's probably perfectly lawfully taking the data from MN as users have agreed to it, processing on a contractual basis. The way that it's set up appears to be joint controllers, but we'd have to know more details to be able to determine that for certain.
I've been banging on about the risks of FB for years now (I have a long suffering DH who has to listen to me go on about data privacy) and I'm afraid I don't understand why anyone is surprised that practices like this exist.