Re: How is it possible that an app
They can't.
That's exactly what happened.
People just don't read or understand what they are agreeing to.
Especially given that applications either fail to work correctly, or constantly re-request permission should any be removed or not granted.
IIRC it's FB messenger that "needs" the contact permissions to install and work. It's granted as default. So even if you manage to tap/click on "no" the 1000s of times you'll be asked to "let us help you find friends" thing (in the main FB app) every single time, you then grant/agree to that permission automatically upon the installation of FB messenger.
Of course none of that matters if all of your friends have clicked "yes" already, because then they can scrape almost as much about you from them, as they could from you. You can either let them have the lot, wholesale, or they can garner most of it piecemeal from other users.