I think this is disingenuous. we can already import contacts and other sensitive data with no "privacy leak". they're not requiring unvetted import functionality, from the issue:

  Android is able to mediate access to other sensitive data with user consent.