Hi, I wrote this blog post.

Nope, you have to be their friend.

Well, you have to be their Facebook friend. What you do in real life is none of my business.

I would presumably work for anyone you are chatting with; that’s mostly your friends, but there are edge cases like people who asked to become your friends and haven’t accepted yet, friends of friends in a group chat, with whom you might be able to chat, etc. I haven’t tried though.

If you are inclined to, I would strongly recommend you create test accounts there to do so: https://www.facebook.com/whitehat

A. you get way funnier screen grabs, and honestly simpler controls; B. you will get love from the security engineers, which I’ve tried, and is an awesome idea.

As it says in the article, this returns a list of the statuses of your friends, he's not querying people individually. He is, however, storing the records individually, but that's a function of his program, not how the API behaves.