Valid question, not sure why the downvotes. You're right, the server can modify the contact list (and this is used extensively within organizations, and in Snikket to ensure family members can see each other by default).
But this isn't the cause for concern here - if the server is malicious it can broadcast this info without the need to modify your contact list. This again is independent of protocol - if someone wants to log or share the times and durations you are actively connected to their server, they can do so quite easily. It doesn't require XMPP.
Re:XMPP: Admin-in-the-middle
by infosechandbook on Thursday November 04, 2021 @08:41AM
(#29106396)
> the user isn't really in control of who can see this information
Server-side parties (e.g., the admin) can see the status information without adding somebody to the group. It is in cleartext, passing the server.
But in the article they showed how the server administrator can easily add contacts to a user's contact list. So my understanding is that the user isn't really in control of who can see this information, as the server admin could add a new contact that can then see the presence status. Correct?
Edit: formatting