When you upload to an app, the makers of that app have access to your data. Don't get me wrong- that's a bad thing. But if you upload your data publicly, anyone in the world has access to your data. Drastically different.
No way they are running their operation on the cheap and don't have their servers secured against intrusion.
No way they can be inexperienced developers and build an API that leaks information to improperly authenticated requests.
No way they can have a disgruntled employee throw a torrent of it all up when he gets fired.
No way they can get bought by someone with fewer scruples and hand your data over to them as part of the acquisition.
But they aren't really relevant to the parent comment's point, which is that, even with these (potential) holes giving your address book to Path is fundamentally different than posting it publicly. In one instance, your data is public, immediately and unconditionally. In the other, there is potential for abuse that could result in your data becoming public if an arguably unlikely sequence of events were to occur.
So it doesn't make any sense at all for Winer to be challenging PD to engage in a behavior that is simply not analogous to the issue at hand. All that Winer's post does is distort the issue, intentionally or not, and distract from the important debate/conversation that Path's policies initiated. I honestly don't see how that's helpful at all.
[UPDATED: Minor correct for clearer syntax]
I once did a deal with a software publisher that required me to turn over the source code.
One day I came into the office and found a disk clearly labeled as the source for my product, on the receptionists desk.
That was pretty close to public, and I remember that every time I let something sensitive out of my control.
Also every few months I have to change my credit card number because a charge appears that I didn't make. Luckily the credit card companies have developed good algorithms for detecting these. Now you might assume that every company that you give your CC to is being careful not to make it public, but if you believe that, you aren't reading the news.
I think the same applies to apps. There is a sensible middle ground in there somewhere, and the new permission request alerts from Apple will go a long way to helping with that. But no, never any guarantees about anything.