Google is in a bit of a different position. The most information that a malicious app on my friend's phone can access about me is what my friend has stored on their phone about me.
Personal things like messaging history and contact information are certainly enough to build a 'social graph', but what Google does not let apps do is access the information that Google stores about me on their servers just because my friend has both my number and a greedy app on their phone.
Personal things like messaging history and contact information are certainly enough to build a 'social graph', but what Google does not let apps do is access the information that Google stores about me on their servers just because my friend has both my number and a greedy app on their phone.