Yes, if he posts personal information, he has to trust Facebook, but he also has to trust those 35 real friends. Of course malice isn't an issue, since they're

Yes, if he posts personal information, he has to trust Facebook, but he also has to trust those 35 real friends. Of course malice isn't an issue, since they're real friends. But friends aren't always security-conscious with their computers. Someone might borrow his friend's computer and find that it's still logged into Facebook, or that the browser stores the credentials. Someone can sneak a peek while his friend looks at personal information in a cafe. The more real friends are added, the more likely this becomes.