The user_friends
permission is part of the "Basic Permissions" or "Basic Info" - i.e. those permissions which are included by default when a user connects to your application.
From the FB docs on this:
Basic info is part of every request for permissions. It includes several elements from a person's public profile and a list of their friends.
A user's friends can individually control if they want their information available to the applications of friends by adjusting their own privacy settings.
Since this is the default behaviour, I think that if your users are accustomed to using Facebook applications then they will not be scared away by this - if they have installed an application before then they will have seen this before.
Unfortunately, at the moment you cannot prevent it from saying friend list.