I have been following with their API changes since it's major update in early 2013, and anyone could have exploited the phone lookup function easily, because everything is there in the open. I was surprised by how easy it was to decompile the Android app:

  public static boolean NEEDS_FUCKED_UP_NEXUS_422_SETTINGS()

  Timber.d("Looks like camprevs gon hide dis shit", new Object[0]);

There really is no way for the Snapchat team to completely prevent others from reversing their API. A client is the endpoint after all. In order to make things difficult for hackers, they could do the following: 1. Implement a custom protocol over TCP/IP, kind of what Skype does. 2. Obfuscate the hell out of it and everything else. 3. Roll out new updates with both APIs. 4. After a reasonable amount of time, break backwards-compatibility on server side.