I say yes, they should be allowed, and you should be allowed to refuse, and they should be allowed to not hire, and you should be allowed to find a better place to work and breath a sigh of relief since you just dodged a bullet.
"You shouldn't put information into Facebook if you are afraid of that information getting out." I don't.
But people (including you, by your response) do not fully understand the risks they are taking.
More importantly, if I don't want to have someone as my Facebook friend, I have that choice. But I don't have a choice about what policies might be in place at employers my Facebook friends might consider. If you think it through, you begin to see why we have laws related to protecting privacy.
This is within the people's ability to control. Just say no. You can do this as a person. Say no. Explain why. Mock them too.
You're naive if you think the "market" will correct itself such that these types of invasions of privacy are eliminated. When we're talking about people's livelihood you can't expect them to act in such a way that maximizes their rights. They act in a way that maximizes their livelihood, potentially giving up rights that they otherwise would not have. Government is the only thing able to keep employers from having that power.
How about your online banking login information?
Where do you draw the line? Is there any aspect of your private life that they should not be able to ask about and refuse to hire if you do not provide access?