Sorry for the confusion, I was under the impression a publisher key gave you certain read-only permissions on a user given they own your game (this was silly in hindsight)

While the users in question had public profiles, their privacy settings for friends lists were set to private.

Thank you for your help! I now understand what you meant by "as long as users grant your app permission".