That’s very true. Though it wasn’t the contacts upload on its own so much. It was that they were uploaded in the background without permission or notification and your contacts were spammed without your permission.