Comment by bigyabai

> Their logic: You have to be friends with the user to receive this packet. Therefore, a "trust relationship" exists.

That logic is acceptable. You could also DM an offline friend a tracking pixel to reconstruct their activity, a lot of this endpoint security is entirely up to the user.