Facebook policies are very sneaky. Rather than defaulting them to something restrictive, their defaults are very permissive.

I would not be surprised if this thing is undone later.