Sup3r wrotethere is a lot of bugs where you can view facebook private profiles/pictures with javascript . it's not necessary to reveal everything . so not seeing any exploits doesn't mean that there is no way to hack facebook in some way . everything is private.
I'm not sure I understand your statement. Besides, JavaScript is being executed in your browser, so if you can do it with JavaScript, you can do it with anything else.