Many apps grabbed contact lists. Path for instance even had an issue with the FTC due to it [1]. Apple implemented better permissions pretty quickly. I recall other apps doing the same up to 2013.

[1] https://www.ftc.gov/news-events/press-releases/2013/02/path-...