You presume the app sent it and not their servers or a partner service provider. They already grab your address book, including phone numbers. They don't need you after that.
In that case don't you think we would have seen many more reports of this shady practice? This seems to me a combination of purposefully bad UI and the user not paying attention.
Still the same practice spammers use, but very different from "covertly uploading my contacts data and texting everyone without telling me".
