Does it say something, though? If you have hundreds of millions of people using a product, you'll find someone surprised by any given behavior of that product. Combine that with the fact that anything even tangentially related to privacy gets bigtime upvotes on this site, and it's not hard to see how an article like this gets written about a feature that is in fact behaving as most people expect.
If people keep being being surprised by this and writing articles about it, I think it suggests that the behavior is not being communicated clearly.
And I do think that it isn't. It's reasonable behavior, and it might be expected by most people, but I still think that it is not being communicated clearly. I did expect the photos to still be gated behind an auth check, and they're not.
That people keep rediscovering this issue and being surprised by it is says something.