What's going to make them realize it's not profitable? It clearly is. Not only the lax security practices, but the very act of playing the shell game makes them money. If a few million people make lots of noise and post updates to their status about how indignant they are that their city of residence is now public, woohoo! More hits! More ads! It's like printing money.
How many people are actually going to leave Facebook over this? Seriously.
You've been OK all along with Farmville and Mafia Wars having access to everything any of your friends can see, right? Don't tell me you don't have any friends who don't use at least a couple of apps. Everything they can see, the makers of their apps can see.
I think Facebook just takes a stick every now and then and whacks it on the side of hive, just so people will post updates and get all indignant and generate more traffic and ad views. It's not like significant numbers of them are actually going to leave the site. And if they manage to give the false impression that Facebook cares one whit about user privacy when they finally and shed a few bitter crocodile tears about how sorry they are and close the next security "hole" that doesn't matter, all the better.
Facebook sells the information you put on there for money. In return for the money they make from the information you give them, you get access to a social media site. Assume that everything you put on Facebook either is public today or will become public at some point in the future when they finally go bankrupt and their database becomes an asset in receivership, sold to the highest bidder. If you are comfortable with that, and act accordingly, it's a pretty cool site. If you assume they have your best interests at heart, you are sadly mistaken. You are the product, not the customer.