Thats what I have read but who knows. They don't give android instructions there is another thing I noticed. I never registered or activated my FB app on my phone and they still got the contacts which means it must be a thing with Google as well. In all reality, between Facebook, Google, Microsoft/Apple and any other site you have given any info to, its out there and has been for a long time. If anyone wants to steal an identity and is capable, they will. The thing that gets me is that nobody was made aware of the feature on FB or many other privacy changes over the last year or so. Had they mentioned it, it may not have caused the stir it has.
Sadly we all signed up for this and continue handing out info, even after we are made aware of how unsafe it is. I have put in a request to have them remove my account on facebook because the option to do it from your profile just puts it on hold.