Software can be made (more) secure and can be tested (better). The point then is when does it make financial sense for facebook to put the money and man power into tackling these issues on the front end... If users / consumers don't take note of the problems and move to another (currently nonexistent) platform facebook will never have a motivating reason to change.
Perhaps, users have done this to themselves by demanding low cost (free) software with fast release schedules for new features.
You can't put it past big co's (or even small co's, and individuals) to come up with the strategy:
1. We'll do this naughty thing
2. We'll make it look accidental
3. Then if anyone finds out, we'll pretend to be bumpkins
It's a classic foil. Basically, it's a reverse pool shark hustle.
They didn't write any code to "share" this data; they just failed to put safeguards in place to prevent it leaking via HTTP referrers.
I'm willing to put this down to incompetence rather than malice, though of course incompetence is still not great.