There's a trade-off against privacy. Some complicated request/response or zkp thing would have to be built to keep wot intact while preserving user social graph privacy.