I'm pretty sure Facebook is really careful around this stuff. it's illegal for them to ignore your previously made privacy choices. Facebook can't afford to break the law in such an obvious way.
Not one privacy setting that I exerted manual control over ever changed out from under me. Whatever controversies they came under in that time with all the additional accompanying scrutiny, this aspect never changed. Perhaps there are counter examples out there, but that’s how it was for me.