Maybe I'm misunderstanding something. Don't you have to give them your gmail password or some other Google auth? That doesn't seem easy to do accidentally.

Yes they need your password but they mix things in the UI making things close to each other, things pop in and out. Its basically a big trap trying to fish as much as they can from you. I don't even install their phone app knowing they will get access to my contacts.