If they just wanted to cover their asses they could make it default to requiring both people to enter codes but having a setting in the menus, under parental controls, that allows people to send you friend requests. That way you only get requests if you specifically say you want them.