Regardless of your privacy settings, it's public to the system. There have been reports of accounts that can see all accounts, and regardless, if Facebook decided to change their policy, things could become public with no input from you.

You have no expectation of anything on Facebook not being public.

Facebook creates such an impression with the existence of closed and secret groups, private messaging and so on. Now, i don't take their promises of privacy very seriously because I know they could change the ToS at any time and have done so before, but I think the general consumer assumes that the contents of a secret group are at least somewhat secret - not necessarily enough that it would be safe to engage in illegal activity therein, but certainly inaccessible to anyone outside of law enforcement or FB engineers.

It's not very reasonable to insist that everyone conceptualize all assurances as blatant lies all the time.

This is also true of email.

I never said it wasn't? Email often ends up passing through other servers you or your counterpart don't control.

You could in theory have it communicate directly with your counterpart's server over TLS, which would provide a good deal of privacy, but then you're trusting your counterpart's server. Given that most people aren't capable of running a mail server, it's not an ideal solution.

Why would you argue that?