It was.

You needed to be his FB friend, which at the time was limited to 500 (if I remember right).

But if you were, the Graph API gave the same access as it did to others.

Honestly, it would be almost better if that wasn't true. That would mean they knew something was wrong. The problem is they think "I'm fine with this, so everyone else must be too."