Good points -- although I suspect that the reason they don't ask permission is they want to be able to transparently do the kinds of things they've been doing with profile pics for years ("your friends love X, click here").