By that logic, we should remove all friend-level privacy settings entirely. I don't think that would go over well with most of the userbase.
If you want to guess how most of the userbase would react, just imagine how much the average user would care when you told them about this "vulnerability".