Facebook is ambitious; it wants to be a lot of things. It wants to continue to be the service where you talk only to your friends, but it also wants to be other things. We believe we can do other things as well as we've done friend-only social networking. That may be a misjudgement, we'll find out.
Re: your friend list: http://blog.facebook.com/blog.php?post=197943902130
Re: The other settings that became publicly available- I think it was a call they made, balancing what is good for the network and what is reasonable for the individual on a social networking site. Some of it had to do with what privacy was feasible to enforce (given that you had to have Search on the site, and different levels of indexing etc), and I don't necessarily know all the details here.
The primary goal was to /simplify/ privacy settings, and make it more fine-grained, which they've clearly done.
Who your friends are and what groups you are a member of is potentially consequential information. This was the fatal flaw in Livejournal's privacy system. Sure you could make your journal entries friends-only but your profile - your friends list, your interests, your groups and your profile pictures - were always public. If you were involved in anything that you maybe didn't want your current/future employer/cow-orkers (say) to know about, the ONLY safeguard was to keep your username a secret. Well on Facebook, you're supposed to use your real name...
Twitter's UI surprised me. I used the 'public' setting; as their docs described it, I expected @someone messages would be seen only by people following me -and- the recipient. Wrong. When I googled my t-name, all my tweets, including those @ messages, were wide open to the whole net. Whoa!
People see Facebook as a way to privately share their life with friends. That's the foundation on which Facebook was built - that's the core aspect that convinced people to abandon other social networks for FB - and now they are idiotically abandoning that core principal and needlessly exposing their users.
Personally, as a web app developer, I'm confused about the process myself. The privacy dialog seemed to suggest that no matter what my settings are, my name, profile picture, and friends list will be public to all. If I'm being given more choice about my privacy, why is this choice being taken away from me? Until this point, I had the choice of being pretty much invisible from anyone but my friends.
Back when people used Myspace, it was quite open by default as well. The difference is that on Myspace your name could be Donald Duck, your location could be set to Antarctica and nobody cared. You could invent your own privacy controls where they didn't exist. Try doing something that on Facebook and your account will be instantly suspended.
This is not about users being dumb or not. Many intelligent people don't know (or care to know) the intricate details of web apps.