[blunte]

It's not that simple. Facebook's shifting privacy defaults are what enabled some of the deeper reach of the CA mining tactics and are arguably what gave them much more information than probably even Facebook had intended.

That's not to say that people are pretty careless about privacy management (and security), but this went well beyond what the informed public thought was happening (or possible) on FB during those years.