The article doesn't make it clear, are these direct-link photos still subject to the permissions set on them? Would setting a photo's permission to "Only Me" prior to deleting it work around Facebook's failure? If they aren't subject to the photo's permissions, that's a giant security hole, or am I misunderstanding?