The Contacts API does not allow unrestricted access to your Contacts. It presents a picker for you to choose a contact.
The SMS Receiver API is not universal access to SMS messages, it is access to one specific message and only one that contains your domain name in the message text.
Both have very obvious utility to users. They don't look even vaguely terrifying.
I admit, this is exactly what I did :(
appreciate the info