Probably because it's entirely anecdotal and attempts to extrapolate from such a small sample size.

It's more a problem of a biased sample than a small sample - this attack spread through the friend network, and so if one of your Facebook friends is in the attacked/vulnerable group then other ones are also likely to be.

Sure, but that's very different than the logical problem I'm talking about.

Because his friend group is not a random sampling.