This is explained on your Profile settings page: "These settings only control the information people can see on your profile. This information, such as your Pages and list of friends, is still public, so it could appear elsewhere on the site and be accessed by applications you and your friends use."
Here's a more detailed explanation: http://www.facebook.com/privacy/explanation.php