Sure - but it sounds like programmer error, not the privacy violation that the article makes it out to be.
Another app might access your contacts rarely but store them on their server (Facebook!?). I definitely prefer the previous scenario.
Your reasoning is spot on.
Not to snark, but how do you know this? Do you know what actions increment the "This app accessed the contacts list" counter, and how many of those actions a comparable IM/telephony app executes? :)