Yes most sites do ask for permission to upload your contacts, but they do it without needing your password. No need to log in as the user anymore to do this.
https://developers.google.com/gmail/xoauth2_protocol
In practice, I don't know any other email provider who does this.