While Facebook fixed the leak a year ago, any tokens that had already been exposed are still exposed, regardless of your privacy settings. In order to invalidate the tokens you need to change your password.