They had a bunch of blog posts about restricting APIs like this[1]. I think someone can look at the current APIs and see what related friends information they allow. The last time I used FB APIs was in 2012 and the last time I used FB was in 2014, so not up to date with them.
[1] https://about.fb.com/news/2018/04/restricting-data-access/
I believe they made modifications after that, yes.
But if you believe they don't still provide access via substantially similar APIs to "trusted partners", I have a bridge that may interest you...
Is there any evidence that it was actually fixed?