Does it really go that deep? I was under the impression that the app cool only grok that you are a "friend" of you aunt.

Yes. If you're curious what the present-day FB settings are that control this sort of information sharing, see here: https://i.imgur.com/6fyLx18.png

It's located in the user's "Apps" settings [1] under the section, "Apps Others Use: People who can see your info can bring it with them when they use apps. Use this setting to control the categories of information people can bring with them."

[1] https://www.facebook.com/settings?tab=applications&ref=setti...

Yes, it really went that deep. But only if you pinky swore to only use that data to improve your app and then delete it! Facebook changed their API in 2014 and removed that ability, allowing companies to only see the profiles of friends that already had the same app (which the developer already had access to anyway). They claimed it was for user privacy, but really they realized they were giving away the crown jewels and allowing other companies to recreate large swaths of their social graph.

No, it could ask users for permission to turn over their friend's photos/events/etc as well. Mad.