But judging by the past response to privacy issues, there are a lot of people that will complain for a week before jumping headfirst.
I'm betting they're on the brink of slicing dicing and selling everyone's personal information. It's more profitable. It makes use of their principle asset. There are few comparable companies to act as competitors. It's a really big and lucrative market.
And it solves their problem with monetizing mobile.
I think you overestimate the extent to which average users are aware of/care about Facebook's privacy gaffes.
Getting into payment processing will expose them to SOX and PCI compliance. They'll still be able to reset your privacy settings for your profile, but they'd be sued out of business if they did something like that for your payment profile. No matter how much it looks like they do, Facebook rarely makes mistakes.