Your "friend" can download the photo and publish it somewhere else, open for everyone.
* The leaker and the viewers are more traceable, since they're hitting Facebook's servers
* Facebook can cut off access to the photos by reassigning the IDs
* To get the actual link, you have to dig into the Facebook page source; to get the photo, you just have to right-click on it.
This is a stupid, silly threat to worry about. Unless you find a way to predict fbcdn URLs, there's nothing overtly wrong with what Facebook is doing. Plenty of sites rely on the same technique to protect significantly more sensitive information.
> To get the actual link, you have to dig into the Facebook page source
The interface says access is now (going forward) changed, but access doesn't change.
What's overtly wrong with what Facebook is doing shows up in practice in the news every time someone becomes an unexpected celebrity. The person promptly and maybe even preemptively changes their privacy settings, but their images remain available.
http://news.bbc.co.uk/2/hi/8060407.stm
Even if it's technically reasonable, it's not user expected behavior.
If you publish images to the public on Facebook, all bets are simply off. It is a bad idea for Facebook to give people the mistaken idea that any settings change on Facebook could ever take back anything posted to "Everyone" on the site.
More to the point, talking about changing privacy settings, and having the change work, where work is not defined as "defeat tptacek" but "defeat casual users".
The logical conclusion to "It is a bad idea for Facebook to give people the mistaken idea that any settings change on Facebook could ever take back anything" is for Facebook to remove any ability to set privacy more restrictive, ever. I doubt that would be popular.
While "you can't take it back" may be technically correct, most photos aren't being downloaded to repost, merely viewed inline online. There's no reason a user changing privacy to be more restrictive shouldn't expect that change to apply going forward.