So, you have all your settings locked down to 'Friends only'. You think your photos will now only be visible to those people in your friends list? Think again.
Should a friend of yours tag someone who isn't in your friend's list, that person will now have access to it. Meaning your limit to 'Friends only' means nothing.
I emailed Facebook about this, and their response was 'This is by design'.