Ignoring the high cost of moving off Facebook, the simple friend/foe privacy model fails when your mother wants to be your FB friend and you can't hide last weekend's drunken debauchery from her (You're a college undergrad, remember?).

"So don't post that there" is the last thing you want as the site operator, because you want your users generating meaningful (to them) content. Which leads to slightly less straight-forward privacy model if you still want users to post pics, or less content if you keep the straight-forwards privacy. Arguably, there's more to be found on FB, but I'd rate seeing "pics of that party you missed" as an easy way to drive sign-ups in the college crowd.