Well it does seem a bit risky, that said if they used cold storage and proper security measures a reputable company would be fine
Although the NSA knowing what your balance is or asking it is a turnoff for certain.
Edit: Your right I would not trust my coins with them given their privacy policies
Privacy would be the biggest concern.
Another big concern is that facebook accounts get hacked all the time. I can't tell you how often I get spam from people on my friends list that is clearly some kind of spam bot, their account is later recovered and I see a status apologizing.
I know what you mean I have gotten a few spam mails from the contact list selling Product X or Product Y
That said I can't see them messing cold storage if their is no balance on the account so to me it is a measure of how they do the transactions
If its just log into FB then spend its a weak system
If it log into FB get email notification to verify transaction and a 24 hour rule before you can change the address you want to send bitcoins to (As a settings option)
Then it could be fairly secure, that said if they know all your transactions and history then the points above are moot lol.
You may have security but not privacy lol.
Unless it was darkcoin or something with a coinjoined client that they can merge transactions into lol.
Even a 24 hour rule would probably not work. People often post where they are going to be to the public. People often say they will not be on Facebook for "x" amount of time (for lent for example, but for other reasons too - like a vacation where they will not have internet access). If someone were to find a way to hack a Facebook account, wait until they know they will not be checking their facebook for a 24+ hour period, then they could easily get away with all of a user's funds.