So Upguard found a vulnerability in AggregateIQ's systems and downloaded a ton of data and are posting a series of blog posts with analysis of the data to determine AggregateIQ's practices?

Are they not worried about getting hit with the CFAA for unauthorized access to a computer system?

If you know you aren't meant to have access, that's still legally questionable. I think they're relying on the fact that AIQ/CA would rather not draw the attention of unproductive legal action.

Public git repositories are not behind a sign in page. You can see the content of a public get repository with a simple GET request to the webserver.

That was not the case here.

I thought targeting by demographic, area, even “friends of” were already supported natively in FB ad targeting. Same goes for the pixel. It is hard to see what special sauce they are bringing here.