Yes, Bob has full access. Dropbox does not support read-only sharing.
The nightmare scenario is: (1) Alice re-shares my folder with Bob, and I don't know about it. (2) I don't have the "preserve modifications infinitely" option turned on in my Dropbox account. (3) Bob starts to make malicious changes to my files. (4) I discover this more than 30 days later, which means I can't recover the original files.
