This is not true. The old Facebook API gave access to all data the user had access to. This included information (posts, photos…) by “friends” which was not public.