I figured this out after a night sleep. Sometimes our brains function like that.
The problem was actually my call here, It should’ve been “add_foo” not “_add_foo”
data: {
// the value of data.action is the part AFTER 'wp_ajax_' in
// the add_action ('wp_ajax_xxx', 'yyy') in the PHP above
action: '_add_foo'
// ANY other properties of data are passed to your_function()
// in the PHP global $_REQUEST (or $_POST in this case)
},