The thing here is that "you're on a social network in which your friend is someone you personally trust, then it's not that ridiculous to trust that person with the decision to share your data" does not match the legal expectation. If my friend allows Facebook to give my data to Cambridge Analytica, that does not give Facebook any legal grounds to do that - so as Facebook did it, it would be a violation at least of the current laws (the UK pre-GDPR legislation was more limited). You are required to inform the data subject and, if you use consent as the basis, you're required to get consent from the data subject (or their legal guardian), not some other person, even if that person is their friend or family member. My spouse or parent can't consent to sharing data on my behalf, and any terms and conditions to which they agree can't waive my rights.

Also, it's worth noting that there is a big difference between "your friend giving your number to someone who they think you'll get along with" and your friend sharing your name and number to some company - for GDPR, the first is covered by the "personal activity" clause 2.2(d), and the latter is not, so GDPR applies and the consent of that friend isn't sufficient, i.e. the friend is permitted to click "share", however, that does not necessarily mean that the company is permitted to use the data shared in this manner. So every company that expects EU users to share their phone contact lists had better be very careful on what and how they do it - you can't rely on informing users or getting consent as you're informing someone else and getting someone else's consent.