And is that illegal or unethical for any reason?
Yes, it's completely and utterly illegal given that Cambridge Analytica operated from, well, Cambridge - that makes them liable to the Data Protection Act 1998 (and soon the GDPR). British data protection regulations are quite tight, and not quite as "oh, haha, businesses can do whatever

" as the US. They broke the law the moment they exported data abroad without explicit permission, doubly so when they used it for reasons other than those originally provided to data providers (i.e. actual human beings)
If they wanted to take the US approach of "haha if you put it on the Internet then we can literally buttfuck you without asking" approach, they should have run their business from the US.