The only way to prevent people sharing something that you don’t want the whole world seeing is to not post it on Facebook. Even with the privacy settings, there is absolutely nothing stopping someone from sharing something you’ve said to a wider audience. This isn’t actually a breach at Facebook’s end - it’s basically people choosing to copy-paste what they’ve got on their computer screen. If someone really wants to share something you’ve marked as private, there is nothing you can do to stop it - even if they have to type what you said word-for-word in Facebook’s “What’s happening” box. In this sense, Facebook’s privacy settings are a bit misleading since it gives a false sense of security.