Information security typically models risk assessments with two axes for severity, not one. They are not purely consequential; rather, they are both consequenti

Information security typically models risk assessments with two axes for severity, not one. They are not purely consequential; rather, they are both consequential and probabilistic. If you have a 10% chance of SQL injection being present in your application but a 50% chance of it being devastating, and a 90% chance of CSRF being present with a 50% chance of it being devastating, you want to prioritize the CSRF vulnerabilities first. Similarly, yes, it would be really crappy to have a private photo published on Imgur, but from an application security perspective the probability (and thus, risk-adjusted severity) of that is absurdly unrealistic. From a risk policy standpoint, the context of Facebook makes sense for implicitly trusting friends with photos. It's not terribly important or strategic data, and since you're starting from "only a subset of people I select can view this", not "only I can view this", it becomes difficult to design a better policy than what already exists. Even with a much more stringent ACL in place, your friends could just download the file when they view it and distribute it from there, bypassing the link altogether. This is a rabbit hole.