Not common at all. I was an eng at FB when the "View as" feature was being built. I wasn't involved in the project at all, and my memory is hazy (this was prob

Not common at all. I was an eng at FB when the "View as" feature was being built. I wasn't involved in the project at all, and my memory is hazy (this was probably 7 years ago by now), but I remember people being like "wow this is crazy and probably a bad idea". I don't actually know if View As generating access tokens was how it worked originally, or if that was a later refactor. Just, in general, spoofing privacy / access control is really scary, no matter how you do it. However, at the time, Facebook was getting a lot of shit (rightfully) for not helping users understand the privacy model, and the View As feature was actually incredibly useful for helping users understand what was public. So my guess (pure speculation) is that yes, people acknowledged it was scary, but decided the value was worth the cost.