You need to defend against both. Heck, if your social network ever becomes popular you'll need to deal with:
- fake instances / relays meant to vacuum personal data for sale and profit
- identity thieves, both the broad-and-shallow, and the target-a-specific person kind
- governments who got a taste of being a surveillance state thanks to FB and now can't kick the habit
- massive numbers of people who decide to mess with someone at once (like when Twitter or 4ch put a bullseye on some person, whether it's deserved or not)
- bots. bots bots bots.
- maybe your client is super tight and solid, but what if company X decides to fork your client and lures people into using it? Now they have access to each user's stuff, and all their friends? Nice.
Obviously you can't realistically defend agains all of that. But it's worth thinking how best to mitigate before launching.
I'd change that into companies or even governments that actively try to subvert your system.