It’s far worse than that. If you and any two people in your list have done the same, then the app has just been given permission to a whole graph, and on and on. Connections are easy to link up. After awhile, it almost doesn’t matter if you give permission as long as they can infer a long list of possible connections based on everything else they know.