I’m pretty sure that Apple blocks any exporting of contacts without consent, maybe he previously consented and it stored it, or he clicked ok without thinking. Even things that require consent can be engineered to make it easy to thoughtlessly agree