Simply liking something does not let a developer get access to your friend list. You will have to give the app at least basic permission (aka "run/install", which will share your friend names and uids) or extended permissions will get you friend's feed, statuses,birthdays, contact details etc. But extended perms have really poor conversions, so most spammers don't go that far.

Only a matter of time before that gets clickjacked though.