Facebook officially sends arbitrary friends data through the Android/Samung APIs in the normal course of operating the official FB app. It likely also locally c

Facebook officially sends arbitrary friends data through the Android/Samung APIs in the normal course of operating the official FB app. It likely also locally caches a lot of data in a format and on-device storage that Samsung could arbitrarily access. The only thing stopping Samsung from stealing all of your friends data is legal and social, not technical. Is there any evidence that the API was actually used to arbitrarily request and exfiltrate other users profiles? If not, this is strictly only "Facebook allowed other developers to write Facebook apps": there is no way that could possible work without offering an API with this level off access to the app.