At $dayjob-1 we relied on this to pull in your Facebook friends as contacts. Eventually FB limited the scope of this to friends who also had the app.
This was post-v2.0 afaik.
I can confirm this, at least generally. Given access by a user, you had access to all the data the user could access, including the user’s friends’. There may have been exceptions, but, for example, friends’ likes were accessible.
It’s gone from the FB Graph API docs, but the wayback machine still has it: