It's what about an hour to calculate the SHA of all 10 digit numbers in the US?

I was curious: my Laptop needed 18 minutes.

haha, I checked my source and I had the units wrong so I was off by a factor of 1000. Looks like 8x GTX1080s can do almost 3 billion SHA256 hashes per second, so you could just brute force these with no table with the right hardware.

Then the problem is: “You’re leaking your Apple ID to everyone in your contact list!” or more, depending on how exactly they’d plan to distribute Apple IDs to everybody else. The hash of the phone number thing is to provide the “contacts only” airdrop thing.

I'm missing what you are saying, sorry. If I know your email already, nothing is getting leaked. If I don't know your apple ID email, I have to brute force all combinations of email concatenated with your phone number to figure it out. If a stranger doesn't know either piece, they'd have to pre-image the entire space which is nigh impossible (all phone #s X all email addresses)

It’s convenient to just have a phone number be the piece both sides know. It’s not as magical if you need to also give your AppleID to every single contact manually, and if you have some sort of Phone Number to AppleID lookup service it’d be abused just as badly is what I’m saying here.

You're right, but they probably have/want to cover the case where you've given someone just your phone number (or just your email).