You're right, it might be possible to get an insecure application to give you API-accessible information about some other user (e.g., the application contains a page that spits out your entire profile on the screen, and you pass in your target's userid). That information is guarded by a user-specific session key, so the app would have to store each user's session key on the server (or have already cached the response) for it to work. A really insecure application could probably be coerced into making other API calls as well, like sending notifications or uploading photos.
I guess in that case Facebook might want to look in to providing some vulnerability testing tools to developers, or maybe running tests for them to find vulnerabilities. It's definitely a hard problem.