Friends can be accessed similarly, but require an access token (_any_ access token, not just the user's that you're inspecting.
More details at Facebook's API docs: https://developers.facebook.com/docs/reference/api/user/
This would seem to be a bug if so, according to this page in the FB documentation: To get additional information about a user, you must first get their permission. At a high level, you need to get an access token for the Facebook user. After you obtain the access token for the user, you can perform authorized requests on behalf of that user by including the access token in your Graph API requests: