I recall we discussed this a couple weeks ago.

The vulnerability is Facebook's social contract with non-technical users, user trust based on mental models of how it should work. For users of privacy settings, trust matters.

A user knows things they are sharing can be used by those they share with. But when they delete something, in their mental model it's been deleted, and they become (with fair reason) upset if they learn it's not.

If users delete a Facebook post or change its privacy setting, it's gone or inaccessible. If they delete a photo, it's still there and still accessible. That's unexpected behavior.

There's no good non-technical reason text content and image content shouldn't be equally carefully managed by Facebook.

In one case, users can use the first-class well-documented features of their browsers to violate Facebook users' mental model of how much control they have over their photos.

In the other case, users can use less well-documented features of their browsers to violate Facebook users' mental model of how much control they have over their photos.

The fact that Facebook could address the latter problem but hasn't doesn't upset me, because it's mooted by the former problem.

I acknowledge the PR problem they have blundered into by accepting this otherwise insignificant risk, though: bored tech journalists can use it to gin up sensational stories that further the narrative about Facebook's cavalier attitude towards privacy. I'm not suggesting that it was a good call on Facebook's part to do this.

Fully deleting the photo at least reduces the user's attack surface.

Imagine a web application with an SQL Injection flaw. There's a zillion things the application can do to "reduce its attack surface" without fixing the flaw; for instance, it can log you out and lock out your account if you ever cause a SQL syntax error. Of course, virtually of these things are dumb.

Facebook could reduce its attack surface meaningfully by eliminating the static-file CDN. But this isn't a reasonable step to take; it generates minimal (infinitessimal!) privacy advantages for users while drastically complicating their service.

It's a completely unfair expectation. Yes, in some users' mental model, when they delete something it's gone for good. That mental model is objectively wrong. If you share something on the Internet, it is fundamentally impossible to ensure that it is deleted.

There's a subtlety that's missing here. For someone to save and reupload a picture, it has to be sufficiently interesting to warrant that attention. But this use case could be more simple. Suppose I directly link to an image while chatting on IM. The owner of the photo deletes it. A year later I can still reference the same URL.

This is usually how I share images: right-click, copy image address, paste in IM or email.

To your point, yes, these URLs remain in email archives and IM logs.

This is why Flickr changes an image's URL if you change its privacy settings.

I wouldn't to argue that there's no failure mode here, only that it's minimal. The URL you're talking about here is never promoted by the Facebook interface; you're more likely to click on the image, end up on the pretty landing page FB generates, and copy-paste the URL bar.