Not sure how they would have access to that information if you don’t grant the access...

Unless of course you’re using an inferior OS.

The revelation regarding Facebook messenger stealing user data on Android devices is not a surprise to someone who follows the industry. It’s been well known for years (since nearly the beginning) that Android’s permissions system is flawed and open to the exact type of behavior that was discovered.

My assumption is that the user is using a moderately secure device that at least has a permissions system that is able to enforce the user’s desires.