But you could already look at publicly listed events and find out who was attending. This - in principle - isn't exposing any more information than what was previously there. It just makes it easier to access.
Sure, it still sucks. But it's not a major new security breach. All that it exposes is already there.
/[my id]/events
data (empty)
Maybe his privacy settings aren't as stringent as mine?