You're mostly right except for one thing: The extended data download did not include shadow profile data from just your friends. It included shadow profile dat

You're mostly right except for one thing: The extended data download did not include shadow profile data from just your friends. It included shadow profile data from anyone that matched any of your contacts. If zuck@facebook.com was one of your contacts, you would have retrieved all of his data. This could have been used as a very targeted malicious data mining tool. It probably was.