[twitter-dev] Why does friends/ids.xml require auth for a protected user?

[Michael]

Even if a user is protected you can see who they are following from
the twitter website. So, why is it required to have authorization to
get a user's friends' ids on a protected user?