TBH if you are really concerned with privacy, should you really be using Facebook, which is an almost open repository for private information? (Granted, privacy and security options have improved over the past few years, but still...)

I think you might be missing the point. The point is not that Bob isn't a real person - it is in fact that Bob should never be told about Deng Yaping, et al, based on friendship with the OP, since the OPs friends list is marked Private and thus should be off-limits for this kind of thing.