This is a very important point most people don't give a single thought to.
Same principle applies to Meta having my contact data because other people use their products and have me saved on their phone. That shouldn't be happening in the first place.
(The GDPR deems it illegal when it happens in a professional context, so there's that, at least)