I would assume the banal reality is that they heard a lot of adverse publicity about someone who was a major client including claims they'd breached Facebook guidelines around storing data taken from APIs, and demanded a meeting. Which CA, who don't really want to get kicked off Facebook's platform, were happy to oblige, whether they were prepared to disclose much information or not.
Of course, when the ICO gets involved then whether CA breached Facebook's EULA or not is moot, and Facebook become relevant only inasmuch as the question of whether their own executives breached or encouraged breaches of data protection laws.
Of course, when the ICO gets involved then whether CA breached Facebook's EULA or not is moot, and Facebook become relevant only inasmuch as the question of whether their own executives breached or encouraged breaches of data protection laws.