It depends on the privacy settings. Though the several iterations of privacy scaremongering and Facebook changing defaults resulted in people locking up their accounts like crazy, friend lists seem to still be visible semi-publicly for quite a lot of people. With more news like that, this will probably change too, though.