I do not see any problems or any security risks.
All events in the calendar can be made
1. Public. They can be seen by all members. Good for special events, to remind members of special eventss. To ask people to write their representatives to vote a certain way...
2. Private. Only you will see them. Those are for your reminders, your appointments, expected arrival dates, or anything else.

This is very private. Much more private than writing it in you paper agenda :-). Without your password nobody will be able to see them.

What seems to be the problem? Can you explain in more detail?

I do not understand what you mean by:

Looks like you added someone to your "friends list" without noticing. When you do that you will be notified when they are online. There is no way for other members to ad themselves to your list of friends.