So turns out you're totally wrong. I just went to the settings page to kill Buzz completely now that they've added the ability, and the default option is worded as such:

"Show the list of people I'm following and the list of people following me on my public Google profile Learn more"

So that list of followers (people who simply didn't read the splash page and blindly picked "yes") WERE exposed to the public.