My sample-size-of-a-few take is that it's a combination of factors:
1) The probability that a Facebook users at somepoint has had a bad experience with rogue Facebook app publishing personal information (or even an accidental acceptance) or was witness to a friend's experience is non-trivial
2) The increasing awareness of the scope and scale of personal data that is taken from logins and shared with advertisers
3) The demographic shift in Facebook usage to older users
4) The large secular increase in awareness of ongoing privacy and financial information breaches that rightly or wrongly is associated with over-sharing of personal information
Seeing a friend post embarrassing spam or porn is a horror inducing visceral experience. It wakes people up to the fact that Facebook's business is fundamentally unseemly.
Exactly - given an average of 500+ friends and years of being active daily or weekly for a large chunk of that time, the probability that you've at least witnessed an embarrassing incident is many orders of magnitude greater than just having done it yourself.
I really believe there's a high level of wariness among the general FB user population that no amount of marketing or changes in authorization policy can fix. It's a level of trust that's irretrievable.
1) The probability that a Facebook users at somepoint has had a bad experience with rogue Facebook app publishing personal information (or even an accidental acceptance) or was witness to a friend's experience is non-trivial
2) The increasing awareness of the scope and scale of personal data that is taken from logins and shared with advertisers
3) The demographic shift in Facebook usage to older users
4) The large secular increase in awareness of ongoing privacy and financial information breaches that rightly or wrongly is associated with over-sharing of personal information