Fun fact: Whatsapp (Facebook) was recently fined 75 million Euros for this practice under GDPR.
To be pedantic, that was one part of a 225-million-Euro fine. But that practice was specifically broken out as one of the line items, with a dollar amount attached.
And to be more pedantic, the fine wasn't for the practice itself. It was for failing to provide notice to the users whose contact info was harvested. In theory, this practice is acceptable under GDPR if the app immediately informs the user whose contact issue was harvested, and gives them an opportunity to reject.
The 225-million-euro fine is still the second-largest fine issued under GDPR, after Amazon's. The 75-million-euro line item were an individual fine, it would be the fourth-largest after (one of) Google's.