That's not true, Cerseirys.
If your post is set to "friends", only your friends will see it. If they share it, who sees that will depend on their privacy settings - for most people "friends of friends". If someone from that pool of people shared it, it would become available to others based on their security settings, too. If anyone shares it who has "public" privacy settings, everyone can see it.
Not that it matters, because Facebook is so easy to get around anyway. Hence why the media always have images of people who have been in accidents/died/etc before it's even been officially confirmed that it was them. If you know what you are doing, you can access any photos.
If a friend likes or comments, the thing they are liking or commenting on will show for their friends, even if they don't know the original poster.
That's why once you've put it on Facebook, it's in the public domain, because you can't control who interacts with it and what their settings are. You might only share it with a few people, those few people might (accidentally or otherwise) share it with a few more, and on it goes.
OP, you're right, the etiquette would be that he didn't post it without checking for you first. Now that it's live, though, there's little point in making him take it down. It'll be archived anyway.