my impression is the OP is a bit loose and ambiguous in the some of the terms used like "plain text" and "local" etc; and the TC article makes the confusion worse.

So just for the record, are these all of the actual issues?

  - no SSL verification means it's trivial to MITM
  - exposure of other player's emails/bio/birthday/location/exif data in pics
  - address book data is sent unhashed to the server
  - signup emails expose the cleartext password (is this right?)

All important issues, and I'm assuming you've corrected these.

But the way I understand it, there's no reason or way to protect the client from the user him/herself - custom CA install, decompilation, etc are all ways for the user to get to their own data, or their own communication with the server.

So I'm a bit at a loss why the TC article is hammering on the "… and the local file which contained user information did not require any decryption to read."

The OP also mentions the FB tokens being exposed and such - I'm assuming these are only sent over SSL, and other people won't have access to it (with the caveat of the SSL fix), right?