> It takes extra work to upload those contacts, which means several managers and developers decided to do it and then spent time implementing it.

Not really. Facebook is a bunch of autonomous services (registration, access, tracking, activities, etc.) accessing shared databases (chat logs, activities, media uploads, etc.) with some kind of automatic implicit and explicit ACL in place. The suggestion/contact service got access to data provided through the email-not-working-with-oauth-so-let-us-use-automatic-token-delivery-and-confirmation-by-accessing-user-emails because it was told a new source of contacts were available for those users. So, not a straight path.

Accident/Blunder > Evil.

Now. GDPR ? GDPR. And because of GDPR those things aren't supposed to happen in Europe.