Some random person liked a pic of my daughter from her 8th birthday a year ago, then sent me a friend request. I checked my privacy, and it appears to be set so that only friends can see my posts/pictures. I know there are a lot of caveats to that. My dad shared the post, so that could be one way it got out. I haven't found a way to set my privacy so that only my friends can see what I post even if someone else shares it. I'm pretty sure it's possible because I've seen that kind of message when other people have shared things, "this content is not available due to the original poster's settings."
I'll have to walk my dad through his privacy settings, and possibly ask him not to share pictures anymore. I know the only way to keep my pictures 100% private is not to post them, but short of that I want to do everything else I can.