This is exactly why I don't install 3rd-party apps on my primary phone unless they request nothing more than absolutely necessary (e.g. Lampa as a flashlight).

I have a second (backup) phone that I put anything that can't be done via browser (e.g. Lyft and such), but it has nothing on it in terms of contacts or data.

I'm baffled that 98% of people seem to care nothing about privacy risks.