Is good PR not enough? I'd say that bad reputation is actually one of the biggest threats to Facebook in the long term. If they could reinvent themselves as an organization as trustworthy as a bank with your private information, a big reason for going elsewhere would be eliminated.

In the short term, the network effect holds their site together, unless they mess up really bad. In the long term, however, these things do matter and Facebook knows that.