If you share your nudes with the “friends only” privacy settings on facebook, and someone else accesses one of your friends accounts because they reused their password and proceeds to leak those photos, is it the fault of Facebook, your friend, the person leaking them, or you?

Because that is exactly what happened here. Credit stuffing reused passwords and scraping opt-in “friends only” shared data between accounts.