That's on brand. I remember their phone app asking for contacts permission and just taking them all and uploading them to their server.