Exceedingly complex controls like those Facebook offers for privacy always struggle with balance. Keep things too simple, and everyone can understand them but advanced users won't have enough control to tweak the settings the way they want to. That leads to Facebook making decisions for people—a dangerous system. But if you provide every conceivable permutation of privacy setting, you'll confuse the hell out of the people who just want to make one tiny bit of information invisible. That leads to users thinking, "screw it." And that comes to the same result: Facebook makes decisions for people.
I don't know if Facebook has found their desired balance with the current system. It looks as if they've veered toward the "too complicated" side, as many of the company's responses to user queries is "you can already do that."