The root exploit appears almost incidental here - without it the application could do everything it was doing merely by requesting those permissions at install time. The vast majority of people would install it without checking.

Here's some examples of iOS apps doing similar things without requiring a root exploit:

The threat is not theoretical. Several iPhone apps have been pulled from the App Store after being found to be harvesting user data, intentionally or unintentionally. A game called Aurora Feint was uploading all the user contacts to the developer's server, and salespeople from Swiss road traffic information app MogoRoad were calling customers who downloaded the app. Game app Storm8 was sued last fall for allegedly harvesting customer phone numbers without permission, but it later stopped that practice. And users also complained that Pinch Media, an analytics framework used by developers, was collecting data about customer phones.

http://news.cnet.com/8301-27080_3-10446402-245.html