There are many things that an employer shouldn't do but they can and often do them.
People that post on Facebook or any online activity must realize that there is little privacy and even less protection. This also goes for their cell phones and emails.
Most employment in the private sector today is covered by the employer's "At Will Employment Contract". This contract holds the employee's employment at the will of either party, but the important party is the employer.
This allows the employer to dismiss an employee without giving a reason, and even an unlawful act is hard to prove without evidence.
So the Facebook status requirement can easily be subverted by the employer simply asking for your password. As far as I know there is no legal protection against them asking for your password.
Currently, this is an employer market.
So the smart thing to do is have two Facebook accounts, and make one for the employer, and the other one a private friends and family only. Use a nickname or something to differentiate the two accounts.
Move to Google Plus as an alternative, but always be mindful of privacy.