in case anybody was still unsure about this, Facebook and privacy are mutually exclusive concepts.
FB bug inadvertently gave access to photos that were never even shared to a single person.
Being that they took so long to disclose this, GDPR will come into play and come in hard. I really hope they get the max fine of 20% global profits.