I don't think the meaning of "a Facebook node which may or may not actually be a human person"-friend is intended here; if you use the old-fashioned meaning "someone you know in real life, someone you trust and on whom you can depend" of "friend". Then the fear of "but won't my friend hack me?" is defeated by the very definition of "friend".

Also, the PIN alone isn't sufficient for login - your "frenemy" can only use it to verify your request, not to impersonate you.