Facebook's permissions model is very complex. Just imagine a case where Fanny comments on Alice's photo which is shared to a custom friends list, which contains Bert (Alice's friend), who Fanny put on her block list... and that's a simple example.

It has been proposed a number of times to put it all behind an API. I do not know if this has been finished yet. I remember an epic diff comment thread which only ended after the author defended her solution with a mathematical proof of correctness.