" TFA says that it only changes your settings once you click through... but I have been getting new "friend requests" from people I have never heard of this weekend (since the change went into effect), I think because my profile and various other info had already been made public. "

That is highly unlikely, and if so, it's a bug (and you should report it). The code looks up your privacy settings at display time, it doesn't make some sweeping database change.