Hah, interesting. I just tested this on a console and you're right:
unprivileged $ echo "ABABABABABAB" > /dev/fb0
(writes a few pixels into the upper left corner of the screen)
unprivileged $ dd if=/dev/fb0 of=read_fb.dat bs=12 count=1
unprivileged $ cat read_fb.dat
So an unprivileged user can write into and read from the framebuffer. It didn't work under my X server because I haven't configured it to use the framebuffer, but it might work if I changed my configuration (then again, since X has no isolation to speak of and an application can listen in on any another (including mouse movements and key strokes), this doesn't really add anything to the attack surface if you're running under X - Wayland should make this better).
So if I managed to get an unsuspecting user to run a program which read the screen, I could get his plans for world domination (or the parts of it
which are visible on the screen, anyway):
$ cat my-secret-plan-for-world-domination.txt
Or even worse:
unprivileged $ sudo /bin/bash
root $ output-some-privileged-information-to-screen
root $ exit
unprivileged $ program-which-reads-screen
But if you think about this, this really isn't very surprising, because every time you take a screenshot, you're doing the same (on Linux, a quick search reveals fbgrab which takes a screenshot using the framebuffer). So I'd say that any operating system that lets you install programs that are able to take full-screen screenshots has the same issues.
The thing to be aware of, I think, is that someone could install a screen recorder without your knowledge, which would then record your whole session, even if you're not running under X and not expecting it. It's the pendant to a keylogging scenario.
In Qubes OS, the framebuffer is handled by the dom0, so I'd assume that the other vms cannot get access to the whole screen, but just to the part of it that displays their windows. This still means that applications running in the same VM can spy on each other, but not on output generated in another VM, and only a dom0 process could record the whole screen.